Cyber Resilience

CVE-2026-54562

SSRF

SSRF
Published
15 July 2026
Modified
15 July 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0024 16th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-54562 is a medium-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a…

more

non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
Why these techniques?

SSRF in public-facing remote download endpoint enables internal network probing (T1046) and exploitation of the application for unauthorized internal access (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13924Shared CWE-918
CVE-2026-4979Shared CWE-918
CVE-2024-51242Shared CWE-918
CVE-2026-43526Shared CWE-918
CVE-2025-14518Shared CWE-918
CVE-2025-8133Shared CWE-918
CVE-2025-71259Shared CWE-918
CVE-2025-55151Shared CWE-918
CVE-2026-33953Shared CWE-918
CVE-2026-24902Shared CWE-918

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-4 Information Flow Enforcement
  • SI-10 Information Input Validation
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow policies that can explicitly block user-supplied URLs targeting loopback, localhost, or internal-only addresses in the remote download workflow.

SI-10 Information Input Validation good match
prevent

Requires validation of all user-supplied input (POST /api/v4/workflow/download URLs) to reject loopback, IPv6 localhost, and redirect-to-internal targets before the downloader is invoked.

SC-7 Boundary Protection partial match
prevent

Boundary protection mechanisms can be configured to deny or filter outbound connections from the application to internal-only or loopback destinations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure development practices directly include input validation and destination allow-listing that prevent SSRF.

DE.CM-09 partial match
prevents

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
prevents

Network segmentation and egress controls can limit the damage from successful SSRF requests.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.7 Threat intelligence partial match
prevents

Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.

References