Cloudreve EUVD-2026-84527

Requires an authenticated Cloudreve account (prior to 4.18.0) that has been granted remote-download access, since the sink is SrcUri in RemoteDownloadTask.createDownloadTask. The attacker must supply the target as an IPv4-in-IPv6 transition form - NAT64 well-known prefix 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32, or the deprecated IPv4-compatible ::a.b.c.d - wrapping a loopback, private, link-local, or cloud-metadata IPv4. Exploitation is LIMITED by: (1) required authentication plus remote-download privilege (PR:L); (2) IPv4-mapped ::ffff:a.b.c.d forms are already blocked because Go's net.IP.To4 normalizes them, so that vector does not work; (3) the fetch host's network must actually route the chosen transition form to the embedded IPv4, making cloud/NAT64/dual-stack deployments the realistic targets. High-value impact (instance credential theft) applies specifically to cloud-hosted instances exposing a metadata service.

This is a moderate, credible SSRF (CWE-918) whose real-world risk is meaningfully bounded by its prerequisites rather than by raw score. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated account that holds remote-download privilege (PR:L). C:H is justified because the primary payoff is reading internal service responses and cloud instance metadata credentials (e.g., 169.254.169.254), while I:N/A:N are correct since the flaw only reads. No EPSS score, KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not a confirmed-in-the-wild issue. The counterweight to the medium score is that the bug is a specific and elegant filter-bypass: the guard already blocked IPv4-mapped ::ffff: forms, and the fix (commit 1c5cad6d) shows the attacker must know to use NAT64, 6to4, Teredo, or IPv4-compatible IPv6 wrappers, AND the fetch must be performed on a host whose network stack actually routes those transition forms to the embedded IPv4 (NAT64 gateways, dual-stack cloud hosts). Net: a real, patch-worthy issue most dangerous on cloud-hosted Cloudreve instances with instance-metadata exposure, but gated behind authentication and a non-trivial address-encoding trick rather than a spray-and-pray internet threat.

An authenticated user who has been granted remote-download rights on a cloud-hosted Cloudreve instance submits a download task with SrcUri set to a URL whose host is an IPv4-in-IPv6 wrapper such as http://[64:ff9b::a9fe:a9fe]/latest/meta-data/ (NAT64-encoding 169.254.169.254). The SSRF guard classifies the outer IPv6 address as public, the server fetches it, and the metadata-service response - including cloud instance credentials - is exposed back to the attacker. No public POC or KEV entry exists, and the low CVSS complexity is offset by the required remote-download privilege and a network path that routes the transition form.