Executive brief
Cloudreve is a file management and sharing platform used to store and distribute files. An authenticated user can bypass the server's internal-address protections by crafting specially-formed IPv6 addresses that wrap internal IP addresses (like metadata services on cloud platforms). This allows an attacker to steal sensitive cloud credentials and access internal systems that should not be reachable.
Technical details
The vulnerability is a server-side request forgery (SSRF) guard bypass in Cloudreve's ValidateExternalURL function (pkg/request/ssrf.go). The checkIP validation routine uses Go's net.IP classifiers (IsLoopback, IsPrivate, IsLinkLocalUnicast) directly on the outer IPv6 address without decoding IPv4-in-IPv6 transition wrappers. An attacker can craft URLs using NAT64 well-known-prefix (64:ff9b::/96), IPv4-compatible (::a.b.c.d), or 6to4 (2002::/16) addresses that embed internal IPv4 addresses such as 169.254.169.254 (cloud metadata) or RFC 1918 private ranges. Go's classifiers treat these wrappers as normal global IPv6 addresses, so they pass validation; however, the network stack ultimately delivers the request to the embedded IPv4. The fix canonicalizes the resolved address to extract the embedded IPv4 before performing range checks. An authenticated remote-download user can trigger this, requiring no administrative privileges.
Affected products
- Cloudreve Cloudreve <= 4.17.0
Timeline
- 2026-09-22: disclosed: Advisory published
- 2026-09-22: other: CVE-2026-79913 assigned