Vulnerabilities

TI-2026-41963 CVE-2026-58272 · GHSA-29hq-23m2-2j47

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST…

MEDIUM 63

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00394 Published 2026-09-21 Fixed in 2.4.1 CWE-208

TI-2026-41961 CVE-2026-58270 · GHSA-jx63-h26r-8cph

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

MEDIUM 62

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00411 Published 2026-09-21 Fixed in 2.4.0 CWE-1333

TI-2026-41960 CVE-2026-58269 · GHSA-92cr-jxw4-5wjg

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

HIGH 70

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-09-21 Fixed in 2.4.0 CWE-288

TI-2026-41962 CVE-2026-58271 · GHSA-274f-6w77-8qm9

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

HIGH 65

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00219 Published 2026-09-21 Fixed in 2.4.0 CWE-307

TI-2026-35188 CVE-2026-47684 · GHSA-q4x5-8cj6-52wg

Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

HIGH 67

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00222 Published 2026-06-16 Fixed in 2.3.0 CWE-918

TI-2026-29787 CVE-2026-41161 · GHSA-43fj-qp3h-hrh5

Username Enumeration via Timing Attack

HIGH 70

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00333 Published 2026-05-08 Fixed in 2.2.0 CWE-208

TI-2025-41214 CVE-2025-67438 · GHSA-9jmq-xgjm-p8c2

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows…

MEDIUM 60

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00318 Published 2026-02-20 Fixed in 1.9.3 CWE-79

TI-2025-35423 CVE-2025-56869 · GHSA-xh7h-h275-6q2f

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated…

LOW 25

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/servic…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00741 Published 2025-09-19 No fix listed CWE-22