https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T21:29:47.682835+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-54562 fkie_cve-2026-54562 2026-10-04T21:29:47.684548+00:00

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.

 https://vulnerability.circl.lu/vuln/ghsa-x756-g4x3-c64m GHSA-x756-g4x3-c64m — Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses 2026-10-04T21:29:47.684667+00:00

Affected: Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3

## Summary

Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets.

When the remote download permission is granted to a non-admin user group, a normal authenticated user can make the server-side downloader fetch internal-only URLs and then read the fetched response after it is imported into the user's own Cloudreve files.

This does not affect default normal users unless the remote download permission is enabled for their group. However, the permission is a feature-level user-group capability and does not make the user an administrator.

## Attacker requirements

The attacker must be:

- authenticated - non-admin - in a user group where `GroupPermissionRemoteDownload` is enabled

Default normal users are blocked from the affected workflow. In the default install, only the admin group has the remote download permission, while the default `User` group does not.

## Affected endpoint

```http POST /api/v4/workflow/download ```

Follow-up attacker readback was performed through normal workflow and file APIs:

```http GET /api/v4/workflow?category=downloaded... GET /api/v4/file?uri=cloudreve://my... POST /api/v4/file/url ```

## Root cause

The remote download workflow checks whether the user group has remote download permission, but it does not validate the submitted URL before passing it to the downloader.

Relevant code paths:

- `service…