# CVE-2026-79913: Cloudreve SSRF guard bypass via IPv6 transition wrappers

Source: https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79913 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Cloudreve is a file management and sharing platform used to store and distribute files. An authenticated user can bypass the server's internal-address protections by crafting specially-formed IPv6 addresses that wrap internal IP addresses (like metadata services on cloud platforms). This allows an attacker to steal sensitive cloud credentials and access internal systems that should not be reachable.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve), [github.com/cloudreve/Cloudreve (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve), [github.com/cloudreve/Cloudreve/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v3), [github.com/cloudreve/Cloudreve/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-79913 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79913 being exploited in the wild.

**How severe is CVE-2026-79913?** Medium severity, with a CVSS score of 6.5, published 22 September 2026.

**Which products and versions are affected?** Cloudreve <= 4.17.0; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260715072853-1c5cad6dec7e, SEMVER:introduced=0,fixed=4.0.0-20260715072853-1c5cad6dec7e.

**Is there a fix for CVE-2026-79913?** Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715072853-1c5cad6dec7e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79913 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79913?** Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715072853-1c5cad6dec7e or later

  ```sh
  go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260715072853-1c5cad6dec7e
  ```


## Technical details

The vulnerability is a server-side request forgery (SSRF) guard bypass in Cloudreve's ValidateExternalURL function (pkg/request/ssrf.go). The checkIP validation routine uses Go's net.IP classifiers (IsLoopback, IsPrivate, IsLinkLocalUnicast) directly on the outer IPv6 address without decoding IPv4-in-IPv6 transition wrappers. An attacker can craft URLs using NAT64 well-known-prefix (64:ff9b::/96), IPv4-compatible (::a.b.c.d), or 6to4 (2002::/16) addresses that embed internal IPv4 addresses such as 169.254.169.254 (cloud metadata) or RFC 1918 private ranges. Go's classifiers treat these wrappers as normal global IPv6 addresses, so they pass validation; however, the network stack ultimately delivers the request to the embedded IPv4. The fix canonicalizes the resolved address to extract the embedded IPv4 before performing range checks. An authenticated remote-download user can trigger this, requiring no administrative privileges.

## Affected products

- Cloudreve Cloudreve <= 4.17.0

## Identifiers

- CVE-2026-79913
- GHSA-jvh5-97xg-v99f
- GO-2026-6572

## Timeline

- 2026-09-22: disclosed: Advisory published
- 2026-09-22: other: CVE-2026-79913 assigned

## Related threats

- [Cloudreve access control bypass in share validation](https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when)
- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)
- [GO-2026-6289 - Cloudreve's remote download file paths can escape the selected destination directory in…](https://junglewise.ai/threats/go-2026-6289-cloudreve-s-remote-download-file-paths-can-escape-the-0fd07225)