Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.4, published 24 July 2026.

Which products and versions are affected?

Cloudreve <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260626022735-332a9d800205.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Check whether you run Cloudreve, github.com/cloudreve/Cloudreve/v3 (Go) or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Cloudreve SSRF via incorrect authorization in admin node test endpoints

Q: Which products and versions are affected?

Cloudreve <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260626022735-332a9d800205.

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected?

Check whether you run Cloudreve, github.com/cloudreve/Cloudreve/v3 (Go) or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.4 · Published 2026-07-24

Cloudreve is a file management system that supports multiple cloud storage backends. A security flaw allows users with limited 'read-only' administrative access to bypass intended restrictions and trigger the server to make unauthorized network requests. This could be used by an attacker to probe internal network services or interact with other private systems that the Cloudreve server can reach.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.4, published 24 July 2026.
Which products and versions are affected?: Cloudreve <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260626022735-332a9d800205.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a network appliance.
Am I affected?: Check whether you run Cloudreve, github.com/cloudreve/Cloudreve/v3 (Go) or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Cloudreve's administrative API incorrectly enforces authorization scopes on the 'node/test' and 'node/test/downloader' endpoints. While state-changing operations like creating or deleting nodes require the 'Admin.Write' scope, these test endpoints only require 'Admin.Read'. An attacker with a read-scoped OAuth token can provide a malicious node configuration containing an arbitrary URL. The server then performs a POST request to that URL to 'ping' the node, leading to blind SSRF and potential internal network reconnaissance. The issue was addressed by requiring the 'Admin.Write' scope for these test routes.

Affected products

Cloudreve Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4
Cloudreve Cloudreve/v4 < 4.0.0-20260626022735-332a9d800205

Timeline

2026-07-23: disclosed
2026-07-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.