CVE-2026-54562mediumCWE-918

CVE-2026-54562: falha de média gravidade em cloudreve

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Publicada em

Seguir esta CVE+ Monitorar cloudreve+ Monitorar github.com/cloudreve/Cloudreve/v3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
cloudreve · cloudreve
CVEs relacionadas — cloudreve

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54560HIGHCloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claimEPSS 0.6%CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2026-79913MEDIUMCloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressesEPSS 0.4%CVE-2026-25726HIGHCloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)EPSS 0.4%CVE-2026-55495MEDIUMCloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%