EUVD-2026-44687
GHSA-x756-g4x3-c64m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L reflects the required authenticated session with remote download permission; C:H captures full internal response exfiltration; I:N and A:N because no write or denial-of-service impact is present.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.
AnalysisAI
Server-Side Request Forgery in Cloudreve's remote download workflow (versions prior to 4.16.1) enables authenticated users holding the remote download permission to direct the application server to fetch arbitrary internal URLs via POST /api/v4/workflow/download. Because the downloader accepted user-supplied URLs without validating loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, a low-privileged user could exfiltrate responses from internal services - including cloud instance metadata endpoints, internal APIs, or services bound to 127.0.0.1 - by reading the downloaded content from their own Cloudreve file storage. No public exploit has been identified at time of analysis; vendor-released patch 4.16.1 is available.
Technical ContextAI
Cloudreve (CPE: cpe:2.3:a:cloudreve:cloudreve:*:*:*:*:*:*:*:*) is a self-hosted file management and sharing platform written in Go. Its remote download feature delegates URL-fetching to a configured downloader backend (e.g., aria2 or a built-in HTTP client) via the workflow subsystem. The root cause is CWE-918 (Server-Side Request Forgery): user-controlled input at POST /api/v4/workflow/download flowed directly into the downloader without any blocklist or allowlist validation for private/loopback address spaces. The fix, introduced in commit aaebf317a78f2413d74afd66c21a1f3143711312, adds a new pkg/request/ssrf.go module implementing ValidateExternalURL with SSRFOptions. This function blocks loopback addresses, RFC 1918 private ranges, link-local unicast (including the cloud metadata IP 169.254.169.254), CGNAT range 100.64.0.0/10, and well-known localhost hostnames (localhost, ip6-localhost, ip6-loopback). Operators gain a new URLValidation node-level configuration supporting an explicit allowlist of trusted hosts and CIDRs, defaulting to secure (validation enabled) for both new and upgraded nodes.
RemediationAI
Upgrade to Cloudreve 4.16.1 or later, available at https://github.com/cloudreve/cloudreve/releases/tag/4.16.1. The patch introduces SSRF validation by default for all nodes without requiring administrator configuration changes - existing upgraded nodes are protected immediately. If an immediate upgrade is not feasible, restrict the remote download permission to trusted administrators only, which eliminates non-admin exploitation paths. As a network-level compensating control, configure egress firewall rules on the host running Cloudreve to prevent outbound connections to loopback (127.0.0.0/8, ::1), RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and CGNAT (100.64.0.0/10) address spaces - note this approach requires network-layer enforcement and does not protect against DNS rebinding unless DNS responses are also filtered. Post-upgrade, operators can use the new URLValidation node setting to explicitly allowlist any internal hosts that legitimate download workflows need to reach, avoiding blanket disablement of the SSRF check.
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functi
Privilege escalation via OAuth scope enforcement bypass affects Cloudreve self-hosted file management versions 4.12.0 th
Path traversal via improper authorization in Cloudreve's WebDAV handler lets a scoped WebDAV account escape its configur
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today