Is CVE-2026-54562 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54562 being exploited in the wild.

How severe is CVE-2026-54562?

Medium severity, with a CVSS score of 6.5, published 15 July 2026.

Which products and versions are affected?

Cloudreve < 4.16.1, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260606025411-aaebf317a78f, SEMVER:introduced=0,fixed=4.0.0-20260606025411-aaebf317a78f.

Is there a fix for CVE-2026-54562?

Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260606025411-aaebf317a78f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54562 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54562?

Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54562: Cloudreve SSRF in remote download workflow

Q: Which products and versions are affected?

Cloudreve < 4.16.1, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260606025411-aaebf317a78f, SEMVER:introduced=0,fixed=4.0.0-20260606025411-aaebf317a78f.

Q: Is there a fix for CVE-2026-54562?

Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260606025411-aaebf317a78f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54562 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54562?

Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54562 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Cloudreve is a file management system that allows users to store and download files. A vulnerability in the remote download feature allows certain users to trick the server into accessing internal network services or local files that should be private. This could lead to the exposure of sensitive internal data, administrative panels, or system metadata.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-54562 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54562 being exploited in the wild.
How severe is CVE-2026-54562?: Medium severity, with a CVSS score of 6.5, published 15 July 2026.
Which products and versions are affected?: Cloudreve < 4.16.1, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260606025411-aaebf317a78f, SEMVER:introduced=0,fixed=4.0.0-20260606025411-aaebf317a78f.
Is there a fix for CVE-2026-54562?: Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260606025411-aaebf317a78f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54562 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54562?: Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260606025411-aaebf317a78f or later
```
go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260606025411-aaebf317a78f
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Cloudreve's remote download workflow at the `/api/v4/workflow/download` endpoint. The application fails to validate user-supplied URLs before passing them to the downloader (such as Aria2), allowing requests to loopback addresses (127.0.0.1, localhost, [::1]) and internal network ranges. An authenticated attacker with `GroupPermissionRemoteDownload` enabled can fetch content from internal-only HTTP services and subsequently read the response body after it is imported into their Cloudreve file library. The vulnerability also follows redirects to internal targets. A patch is available in version 4.0.0-20260606025411-aaebf317a78f (released as part of 4.16.1).

Affected products

Cloudreve Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4
Cloudreve Cloudreve/v4 < 4.0.0-20260606025411-aaebf317a78f

Identifiers

CVE-2026-54562
GHSA-x756-g4x3-c64m
GO-2026-6023

Timeline

2026-07-15: advisory: NVD published date
2026-07-20: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.