# CVE-2026-54562: Cloudreve SSRF in remote download workflow

Source: https://junglewise.ai/threats/cve-2026-54562-cloudreve-ssrf-in-remote-download-workflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-54562 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Cloudreve is a file management system that allows users to store and download files. A vulnerability in the remote download feature allows certain users to trick the server into accessing internal network services or local files that should be private. This could lead to the exposure of sensitive internal data, administrative panels, or system metadata.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve), [github.com/cloudreve/Cloudreve (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve), [github.com/cloudreve/Cloudreve/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v3), [github.com/cloudreve/Cloudreve/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54562 being exploited in the wild.

**How severe is CVE-2026-54562?** Medium severity, with a CVSS score of 6.5, published 15 July 2026.

**Which products and versions are affected?** Cloudreve < 4.16.1, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260606025411-aaebf317a78f, SEMVER:introduced=0,fixed=4.0.0-20260606025411-aaebf317a78f.

**Is there a fix for CVE-2026-54562?** Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260606025411-aaebf317a78f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54562 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54562?** Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260606025411-aaebf317a78f or later

  ```sh
  go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260606025411-aaebf317a78f
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Cloudreve's remote download workflow at the `/api/v4/workflow/download` endpoint. The application fails to validate user-supplied URLs before passing them to the downloader (such as Aria2), allowing requests to loopback addresses (127.0.0.1, localhost, [::1]) and internal network ranges. An authenticated attacker with `GroupPermissionRemoteDownload` enabled can fetch content from internal-only HTTP services and subsequently read the response body after it is imported into their Cloudreve file library. The vulnerability also follows redirects to internal targets. A patch is available in version 4.0.0-20260606025411-aaebf317a78f (released as part of 4.16.1).

## Affected products

- Cloudreve Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4
- Cloudreve Cloudreve/v4 < 4.0.0-20260606025411-aaebf317a78f

## Identifiers

- CVE-2026-54562
- GHSA-x756-g4x3-c64m
- GO-2026-6023

## Timeline

- 2026-07-15: advisory: NVD published date
- 2026-07-20: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/baradika](https://api.github.com/users/baradika)
- [https://github.com/baradika](https://github.com/baradika)
- [https://api.github.com/users/baradika/gists%7B/gist_id%7D](https://api.github.com/users/baradika/gists%7B/gist_id%7D)
- [https://api.github.com/users/baradika/repos](https://api.github.com/users/baradika/repos)
- [https://avatars.githubusercontent.com/u/137510281?v=4](https://avatars.githubusercontent.com/u/137510281?v=4)
- [https://api.github.com/users/baradika/events%7B/privacy%7D](https://api.github.com/users/baradika/events%7B/privacy%7D)

## Related threats

- [Cloudreve access control bypass in share validation](https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when)
- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve SSRF guard bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)