x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v3: GHSA-v6w6-358x-2433

[GoVulnBot]

Advisory GHSA-v6w6-358x-2433 references a vulnerability in the following Go modules:

Module
github.com/cloudreve/Cloudreve
github.com/cloudreve/Cloudreve/v3
github.com/cloudreve/Cloudreve/v4

Description:

Summary

Cloudreve exposes two admin node test endpoints under the Admin.Read OAuth scope. These endpoints accept attacker-controlled node definitions and cause Cloudreve to make outbound server-side network requests. This allows an OAuth client authorized only for Admin.Read to trigger operational network actions that should require Admin.Write.

Impact

An attacker who obtains an admin-authorized OAuth token with Admin.Read but not Admin.Write can make the Cloudreve server connect to arbitrary URLs supplied in the request body. This can be used for blind SSRF, internal servic...

References:

• ADVISORY: GHSA-v6w6-358x-2433
• ADVISORY: GHSA-v6w6-358x-2433
• FIX: cloudreve/cloudreve@332a9d8
• WEB: https://github.com/cloudreve/cloudreve/releases/tag/4.17.0

Cross references:

• github.com/cloudreve/Cloudreve appears in 3 other report(s):
  • data/reports/GO-2026-5350.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v4: GHSA-f8xp-wvcx-p6f4 #5350)
  • data/reports/GO-2026-6022.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v4: GHSA-vgj4-345g-jcf8 #6022)
  • data/reports/GO-2026-6023.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v3: GHSA-x756-g4x3-c64m #6023)
• github.com/cloudreve/Cloudreve/v3 appears in 4 other report(s):
  • data/excluded/GO-2022-1020.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v3: GHSA-fg25-gq9g-32mx #1020) EFFECTIVELY_PRIVATE
  • data/reports/GO-2026-5350.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v4: GHSA-f8xp-wvcx-p6f4 #5350)
  • data/reports/GO-2026-6022.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v4: GHSA-vgj4-345g-jcf8 #6022)
  • data/reports/GO-2026-6023.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v3: GHSA-x756-g4x3-c64m #6023)
• github.com/cloudreve/Cloudreve/v4 appears in 3 other report(s):
  • data/reports/GO-2026-5350.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v4: GHSA-f8xp-wvcx-p6f4 #5350)
  • data/reports/GO-2026-6022.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v4: GHSA-vgj4-345g-jcf8 #6022)
  • data/reports/GO-2026-6023.yaml (x/vulndb: potential Go vuln in github.com/cloudreve/Cloudreve/v3: GHSA-x756-g4x3-c64m #6023)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cloudreve/Cloudreve
      vulnerable_at: 0.0.0-20201026073328-746aa3e8ef26
    - module: github.com/cloudreve/Cloudreve/v3
      vulnerable_at: 3.0.0-20250225100611-da4e44b77af4
    - module: github.com/cloudreve/Cloudreve/v4
      versions:
        - fixed: 4.0.0-20260626022735-332a9d800205
summary: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve
ghsas:
    - GHSA-v6w6-358x-2433
references:
    - advisory: https://github.com/advisories/GHSA-v6w6-358x-2433
    - advisory: https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433
    - fix: https://github.com/cloudreve/cloudreve/commit/332a9d800205082a2469e555fd66a63f18d9d5dc
    - web: https://github.com/cloudreve/cloudreve/releases/tag/4.17.0
notes:
    - fix: 'github.com/cloudreve/Cloudreve/v4: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
    id: GHSA-v6w6-358x-2433
    created: 2026-07-24T22:02:11.172245034Z
review_status: UNREVIEWED