Cloudreve, a self‑hosted file management system, includes a server‑side request forgery guard that validates external URLs. The guard passes resolved addresses to a checkIP function without decoding IPv6‑transition forms such as NAT64, IPv4‑compatible, and 6to4. An authenticated user with remote‑download permissions can supply a SrcUri that embeds an IPv4 address within an IPv6 transition wrapper. Because the wrapper is not decoded, the guard incorrectly classifies the address as public, allowing Cloudreve to fetch responses from internal or cloud‑metadata endpoints. This can expose internal service data and credentials stored in instance metadata.

All Cloudreve deployments running a version earlier than 4.18.0 are affected. The issue is fixed in release 4.18.0 and later. The vendor is Cloudreve (cloudreve:cloudreve).

The CVSS score is 6.5, indicating a moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with remote‑download access; therefore the attacker must first obtain valid credentials. Based on the description, it is inferred that exploitation is limited to authenticated users. Once authenticated, an attacker can craft a URL that bypasses the SSRF guard, leading to internal service exposure and potential credential leakage. Network segmentation and internal IP filtering can mitigate the impact if patching is delayed.