Is CVE-2026-79913 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79913 being exploited in the wild.

How severe is CVE-2026-79913?

Medium severity, with a CVSS score of 6.5, published 22 September 2026.

Which products and versions are affected?

Cloudreve <= 4.17.0; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260715072853-1c5cad6dec7e, SEMVER:introduced=0,fixed=4.0.0-20260715072853-1c5cad6dec7e.

Is there a fix for CVE-2026-79913?

Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715072853-1c5cad6dec7e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79913 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79913?

Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79913: Cloudreve SSRF guard bypass via IPv6 transition wrappers

Q: Which products and versions are affected?

Cloudreve <= 4.17.0; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260715072853-1c5cad6dec7e, SEMVER:introduced=0,fixed=4.0.0-20260715072853-1c5cad6dec7e.

Q: Is there a fix for CVE-2026-79913?

Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715072853-1c5cad6dec7e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-79913 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-79913?

Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79913 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Cloudreve is a file management and sharing platform used to store and distribute files. An authenticated user can bypass the server's internal-address protections by crafting specially-formed IPv6 addresses that wrap internal IP addresses (like metadata services on cloud platforms). This allows an attacker to steal sensitive cloud credentials and access internal systems that should not be reachable.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-79913 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79913 being exploited in the wild.
How severe is CVE-2026-79913?: Medium severity, with a CVSS score of 6.5, published 22 September 2026.
Which products and versions are affected?: Cloudreve <= 4.17.0; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260715072853-1c5cad6dec7e, SEMVER:introduced=0,fixed=4.0.0-20260715072853-1c5cad6dec7e.
Is there a fix for CVE-2026-79913?: Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715072853-1c5cad6dec7e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79913 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79913?: Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715072853-1c5cad6dec7e or later
```
go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260715072853-1c5cad6dec7e
```

Technical details

The vulnerability is a server-side request forgery (SSRF) guard bypass in Cloudreve's ValidateExternalURL function (pkg/request/ssrf.go). The checkIP validation routine uses Go's net.IP classifiers (IsLoopback, IsPrivate, IsLinkLocalUnicast) directly on the outer IPv6 address without decoding IPv4-in-IPv6 transition wrappers. An attacker can craft URLs using NAT64 well-known-prefix (64:ff9b::/96), IPv4-compatible (::a.b.c.d), or 6to4 (2002::/16) addresses that embed internal IPv4 addresses such as 169.254.169.254 (cloud metadata) or RFC 1918 private ranges. Go's classifiers treat these wrappers as normal global IPv6 addresses, so they pass validation; however, the network stack ultimately delivers the request to the embedded IPv4. The fix canonicalizes the resolved address to extract the embedded IPv4 before performing range checks. An authenticated remote-download user can trigger this, requiring no administrative privileges.

Affected products

Cloudreve Cloudreve <= 4.17.0

Identifiers

CVE-2026-79913
GHSA-jvh5-97xg-v99f
GO-2026-6572

Timeline

2026-09-22: disclosed: Advisory published
2026-09-22: other: CVE-2026-79913 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.