Vulnerabilidades de Sync-in
CVEs publicadas que afetam produtos de Sync-in: 3 registro(s), com severidade, exploração e correções.
CVE-2026-47684
Alta · 7.7
CWE-918 16/06/2026
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.
CVE-2026-41161
Média · 5.3
CWE-208 08/05/2026
Username Enumeration via Timing Attack
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This issue has been patched in version 2.2.0.
CVE-2025-67438
Média · 6.1
CWE-79 20/02/2026
Cross-site Scripting (XSS) em Sync-in Sync-in Server
A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.