Cloudreve’s remote download endpoint accepts URLs supplied by users and forwards them to the underlying downloader without filtering loopback, localhost or internal addresses. As a result, a non‑admin user can trigger the server to fetch any internal resource and store the obtained content in the user’s own account, effectively leaking internal network data. This flaw maps to CWE‑918, a Server Side Request Forgery vulnerable to unauthorized access of internal services.

The vulnerability is present in all Cloudreve versions earlier than 4.16.1. Administrators should check that their deployed instance does not run a vulnerable release; the flaw is tied to the /api/v4/workflow/download API and applies to any user with remote download permission, regardless of administrative status.

The CVSS score is 6.5, indicating medium severity, while the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with remote download rights and a crafted POST request pointing to a loopback or internal URL; the server will then retrieve and store the target’s response in the attacker’s account, potentially revealing sensitive internal data.