CVE-2026-108555lowCWE-348

CVE-2026-108555: falha de baixa gravidade em schlagmichdoch PairDrop

PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header

Publicada em 10 out 2026 · Atualizada em 13 out 2026

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.1%

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

schlagmichdoch · PairDrop

Referências

https://github.com/schlagmichdoch/PairDrop https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/peer.js#L44-L54 https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/ws-server.js#L312-L314 https://github.com/schlagmichdoch/PairDrop/issues/510 https://www.vulncheck.com/advisories/pairdrop-through-1.11.2-ip-spoofing-via-cf-connecting-ip-header