DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-79913: CVE-2026-79913: Server-Side Request Forgery Bypass via IPv6 Transition Addresses in Cloudreve

#security #cve #cybersecurity

CVE-2026-79913: Server-Side Request Forgery Bypass via IPv6 Transition Addresses in Cloudreve

Vulnerability ID: CVE-2026-79913
CVSS Score: 6.5
Published: 2026-09-22

Cloudreve versions prior to 4.18.0 contain a Server-Side Request Forgery (SSRF) vulnerability. The application's validation logic fails to canonicalize various IPv4-in-IPv6 transition formats, such as NAT64, 6to4, and Teredo addresses. Consequently, an authenticated user with remote-download permissions can issue requests that bypass SSRF network boundaries, enabling connection routing to loopback, private, or cloud metadata endpoints.

TL;DR

A validation logical flaw in Cloudreve allowed attackers to bypass SSRF defenses. By wrapping forbidden private IPv4 targets in IPv6 transition blocks, the application verified them as safe public IPs, while the underlying OS routed them to private internal endpoints.

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.5
  • Exploit Status: None
  • KEV Status: Not Listed
  • Attack Complexity: Low

Affected Systems

  • Cloudreve Community Edition
  • Cloudreve: < 4.18.0 (Fixed in: 4.18.0)

Code Analysis

Commit: 1c5cad6

Normalize IPv4-in-IPv6 transition forms to fix SSRF bypass

Mitigation Strategies

  • Upgrade Cloudreve to version 4.18.0 or later to patch the core validation flaw.
  • Apply egress firewall filters to drop outbound IPv6 traffic destined for NAT64, 6to4, or Teredo blocks.
  • Enforce IMDSv2 with a session hop limit of 1 on cloud infrastructure hosting the application.

Remediation Steps:

  1. Identify the current active version of Cloudreve by checking the admin console or application container.
  2. Download the 4.18.0 release binary or update the Docker image tag to 4.18.0.
  3. Restart the Cloudreve service to load the updated executable and run automated checks to verify functionality.
  4. Review user group permissions and restrict remote download permissions to highly trusted accounts.

References

Read the full report for CVE-2026-79913 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)