CVE-2026-54562: Cloudreve SSRF Vulnerability

CVE-2026-54562 Overview

Cloudreve is a self-hosted file management and sharing system that supports remote download workflows for fetching files from user-supplied URLs. Versions prior to 4.16.1 contain a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the remote download endpoint. The POST /api/v4/workflow/download handler passes user-supplied URLs to the configured downloader without validating against loopback addresses, localhost hostnames, IPv6 localhost, or redirect-to-loopback targets. A non-admin user with remote download permission can fetch internal-only URLs and read the response content after it is imported into the user's own files.

Critical Impact
Authenticated non-admin users with remote download permission can read responses from internal-only services, exposing metadata endpoints, internal APIs, and other assets reachable from the Cloudreve host.

Affected Products

Cloudreve versions prior to 4.16.1
Self-hosted Cloudreve deployments with remote download permission granted to non-admin users
Instances using the built-in downloader without external SSRF filtering

Discovery Timeline

2026-07-15 - CVE-2026-54562 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-54562

Vulnerability Analysis

The vulnerability resides in Cloudreve's remote download workflow. The endpoint POST /api/v4/workflow/download accepts arbitrary URLs from authenticated users holding the remote download permission. The downloader fetches those URLs and stores the response content in the requesting user's file space.

Because the downloader performs no allowlist or denylist checks on the target host, attackers can point it at loopback addresses such as 127.0.0.1, localhost, or the IPv6 form [::1]. HTTP redirects to loopback targets are also honored, defeating naive front-end URL checks. After the fetch completes, the response body is imported as a file the attacker owns, enabling direct read of internal service responses.

The issue is classified as SSRF [CWE-918]. It does not require administrator privileges, only the remote download capability that many deployments extend to standard users.

Root Cause

The downloader trusted user-supplied URLs and did not enforce SSRF policy on the resolved destination. Neither the initial hostname nor post-redirect targets were checked against internal address ranges, and no configuration option existed to require such validation on downloader nodes.

Attack Vector

An authenticated user with remote download permission submits a crafted URL through the workflow endpoint. The URL targets an internal service, a cloud metadata endpoint, or an external server that issues a 302 redirect to a loopback address. Cloudreve fetches the resource and writes the response into the attacker's file storage, where it can be downloaded and inspected.

		// 下载监控间隔
		Interval       int  `json:"interval,omitempty"`
		WaitForSeeding bool `json:"wait_for_seeding,omitempty"`
+		// URLValidation controls SSRF policy applied to user-supplied URLs
+		// fetched by this node's downloader. nil means the secure default
+		// (validation on, no extra allowlist) — existing nodes upgraded in
+		// place stay protected without admin action.
+		URLValidation *URLValidationSetting `json:"url_validation,omitempty"`
+	}
+
+	URLValidationSetting struct {
+		// Disabled turns the SSRF check off entirely on this node. Only set
+		// this when the downloader runs in a network segment that cannot
+		// reach any internal asset (e.g. dedicated egress namespace).
+		Disabled bool `json:"disabled,omitempty"`
+		// AllowedHosts is a list of hostnames or IP literals that bypass all
+		// checks. Exact, case-insensitive match against url.Hostname().
+		AllowedHosts []string `json:"allowed_hosts,omitempty"`
+		// AllowedCIDRs is a list of CIDR blocks (IPv4 or IPv6) whose IPs are
+		// treated as safe even if they would otherwise be rejected (private,
+		// link-local, etc.).
+		AllowedCIDRs []string `json:"allowed_cidrs,omitempty"`
	}

Source: GitHub Commit aaebf317 — the patch introduces URLValidationSetting on downloader nodes, enabling SSRF checks by default and allowing operators to configure host or CIDR allowlists.

Detection Methods for CVE-2026-54562

Indicators of Compromise

Access log entries for POST /api/v4/workflow/download containing target URLs with hostnames like 127.0.0.1, localhost, 0.0.0.0, [::1], or private RFC 1918 ranges.
Files imported into user storage whose original source URL points to internal infrastructure or cloud metadata endpoints such as 169.254.169.254.
Downloader egress connections to loopback interfaces or internal subnets originating from the Cloudreve process.

Detection Strategies

Parse Cloudreve application logs for workflow download submissions and flag any target host that resolves to a private, loopback, or link-local address.
Correlate authenticated non-admin session activity with newly created files whose source URL falls inside internal network ranges.
Alert on any HTTP redirect chain terminating at a loopback or metadata address when initiated by the Cloudreve downloader.

Monitoring Recommendations

Enable outbound network monitoring on the Cloudreve host and alert on downloader traffic destined for internal ranges or the cloud metadata service.
Audit which roles hold the remote download permission and monitor role assignment changes.
Retain download workflow request bodies for post-incident review of submitted URLs.

How to Mitigate CVE-2026-54562

Immediate Actions Required

Upgrade Cloudreve to version 4.16.1 or later, which enables SSRF validation by default on downloader nodes.
Restrict the remote download permission to trusted users until the upgrade is complete.
Block egress from the Cloudreve host to cloud metadata endpoints and internal management interfaces at the network layer.

Patch Information

The fix is available in Cloudreve 4.16.1. See the GitHub Release 4.16.1 and the GitHub Security Advisory GHSA-x756-g4x3-c64m. The patch introduces a URLValidation configuration on downloader nodes that blocks loopback, private, and link-local destinations by default and follows redirects through the same policy.

Workarounds

Run the Cloudreve downloader in a dedicated network namespace or egress-only segment with no route to internal assets.
Place an egress proxy in front of the downloader and enforce an allowlist of permitted external destinations.
Remove the remote download permission from all non-admin roles until patching is complete.

bash

# Example downloader node URLValidation setting (post-patch, 4.16.1+)
# Applied via node configuration JSON
{
  "url_validation": {
    "disabled": false,
    "allowed_hosts": ["files.example.com"],
    "allowed_cidrs": ["192.168.10.0/24"]
  }
}