Read the docs
TI-2026-70553 Aliases CVE-2026-108555GHSA-4p3m-fhg8-5wfc

IP spoofing in PairDrop via forged cf-connecting-ip header

Priority LOW 11CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

PairDrop through 1.11.2 trusts a client-supplied cf-connecting-ip header when Peer._setIP sets a peer's IP address, which is a use of a less trusted source (CWE-348). A remote unauthenticated attacker who knows a victim's public IP can forge that header and join the victim's local discovery room, appearing as a local device to send or receive files. The flaw affects self-hosted instances that are not behind Cloudflare.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00135 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
schlagmichdochPairDropup to 1.11.2—No fix listedCNA
  • PairDrop Vendorschlagmichdoch Affected up to 1.11.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for PairDrop.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108555
  2. 2026-10-11 Alias added: GHSA-4p3m-fhg8-5wfc
  3. 2026-10-13 CISA SSVC decision points changed

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences