CVE-2026-79913

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.

• CWE-697
• CWE-918

• https://github.com/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2
• https://github.com/cloudreve/cloudreve/releases/tag/4.18.0
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79908Acrobat Reader is affected by an out-of-bounds write vulnera…7.8
• CVE-2026-79909Acrobat Reader is affected by a Use After Free vulnerability…7.8
• CVE-2026-7991Use after free in UI in Google Chrome prior to 148.0.7778.96…8.8
• CVE-2026-79910Acrobat Reader is affected by an out-of-bounds read vulnerab…5.5
• CVE-2026-79911A security vulnerability has been detected in TOTOLINK N600R…10
• CVE-2026-79912A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_…8.3
• CVE-2026-79916MaxKB is an open-source AI assistant for enterprise. Prior t…9.1
• CVE-2026-79917MaxKB is an open-source AI assistant for enterprise. In 2.7.…6.5
• CVE-2026-79918MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-79919MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-7992Insufficient validation of untrusted input in UI in Google C…8.8
• CVE-2026-79920Ajenti is a Linux & BSD modular server admin panel. Prior to…9.9