{"vulnerability": "cve-2026-79913", "sightings": [{"uuid": "6d73e16c-bd22-47b4-aac3-cdca3dd1363e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-79913", "type": "published-proof-of-concept", "source": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f", "content": "", "creation_timestamp": "2026-09-22T22:35:08.258602Z"}, {"uuid": "5683fbbf-1836-4ec0-b9f3-786292d01b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79913", "type": "seen", "source": "https://gist.github.com/alon710/57edfd5f29828b39c794e053b9ab7b82", "content": "# CVE-2026-79913: CVE-2026-79913: Server-Side Request Forgery Bypass via IPv6 Transition Addresses in Cloudreve\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-79913\n\n## Summary\nCloudreve versions prior to 4.18.0 contain a Server-Side Request Forgery (SSRF) vulnerability. The application's validation logic fails to canonicalize various IPv4-in-IPv6 transition formats, such as NAT64, 6to4, and Teredo addresses. Consequently, an authenticated user with remote-download permissions can issue requests that bypass SSRF network boundaries, enabling connection routing to loopback, private, or cloud metadata endpoints.\n\n## TL;DR\nA validation logical flaw in Cloudreve allowed attackers to bypass SSRF defenses. By wrapping forbidden private IPv4 targets in IPv6 transition blocks, the application verified them as safe public IPs, while the underlying OS routed them to private internal endpoints.\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n- **Attack Complexity**: Low\n\n## Affected Systems\n\n- Cloudreve Community Edition\n- **Cloudreve**: < 4.18.0 (Fixed in: `4.18.0`)\n\n## Mitigation\n\n- Upgrade Cloudreve to version 4.18.0 or later to patch the core validation flaw.\n- Apply egress firewall filters to drop outbound IPv6 traffic destined for NAT64, 6to4, or Teredo blocks.\n- Enforce IMDSv2 with a session hop limit of 1 on cloud infrastructure hosting the application.\n\n**Remediation Steps:**\n1. Identify the current active version of Cloudreve by checking the admin console or application container.\n2. Download the 4.18.0 release binary or update the Docker image tag to 4.18.0.\n3. Restart the Cloudreve service to load the updated executable and run automated checks to verify functionality.\n4. Review user group permissions and restrict remote download permissions to highly trusted accounts.\n\n## References\n\n- [Cloudreve Security Advisory](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f)\n- [Fix Commit 1c5cad6](https://github.com/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2)\n- [Cloudreve 4.18.0 Release](https://github.com/cloudreve/cloudreve/releases/tag/4.18.0)\n- [CVE-2026-79913 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-79913)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-79913) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T02:32:16.533715Z"}]}