CVE-2026-47684

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47684", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:18:20.402Z", "datePublished": "2026-06-16T14:31:30.807Z", "dateUpdated": "2026-06-16T17:10:12.548Z"}, "containers": {"cna": {"title": "Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg"}, {"name": "https://github.com/Sync-in/server/releases/tag/v2.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Sync-in/server/releases/tag/v2.3.0"}], "affected": [{"vendor": "Sync-in", "product": "server", "versions": [{"version": "< 2.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T14:31:30.807Z"}, "descriptions": [{"lang": "en", "value": "Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue."}], "source": {"advisory": "GHSA-q4x5-8cj6-52wg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T17:01:38.857420Z", "id": "CVE-2026-47684", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T17:10:12.548Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47684", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:18:20.402Z", "datePublished": "2026-06-16T14:31:30.807Z", "dateUpdated": "2026-06-16T17:10:12.548Z"}, "containers": {"cna": {"title": "Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg"}, {"name": "https://github.com/Sync-in/server/releases/tag/v2.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Sync-in/server/releases/tag/v2.3.0"}], "affected": [{"vendor": "Sync-in", "product": "server", "versions": [{"version": "< 2.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T14:31:30.807Z"}, "descriptions": [{"lang": "en", "value": "Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue."}], "source": {"advisory": "GHSA-q4x5-8cj6-52wg", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47684", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T17:01:38.857420Z"}}}], "references": [{"url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T17:01:51.847Z"}}]}}

{"affected": [{"affectedData": [{"product": "server", "vendor": "Sync-in", "versions": [{"status": "affected", "version": "< 2.3.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue."}, {"lang": "es", "value": "Sync-in Server es una plataforma segura de c\u00f3digo abierto para almacenamiento de archivos, compartici\u00f3n, colaboraci\u00f3n y sincronizaci\u00f3n. Antes de la versi\u00f3n 2.3.0, la expresi\u00f3n regular de la lista de bloqueo de IP privadas utilizada en la funci\u00f3n de descarga de URL no coincide con las direcciones IPv6 mapeadas a IPv4 (p. ej. ::ffff:127.0.0.1), permitiendo que la protecci\u00f3n SSRF sea eludida en sistemas de doble pila. La versi\u00f3n 2.3.0 soluciona el problema."}], "id": "CVE-2026-47684", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47684", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T17:01:38.857420Z", "version": "2.0.3"}}]}, "published": "2026-06-16T15:16:41.063", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Sync-in/server/releases/tag/v2.3.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "server", "source": "cna", "vendor": "Sync-in"}, "product": "server", "vendor": "sync-in"}], "created": "2026-06-16T17:00:13.035427+00:00", "updated": "2026-06-17T21:45:02.800385+00:00", "vendors": ["sync-in", "sync-in$PRODUCT$server"]}