CVE-2026-58270: falha de média gravidade em Sync-in server
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.4%
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Sync-in · serverCVEs relacionadas — Sync-in server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-58272MEDIUMSync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)EPSS 0.4%CVE-2026-41161MEDIUMUsername Enumeration via Timing AttackEPSS 0.3%CVE-2026-58269HIGHSync-in Server has a complete 2FA Bypass via `POST /api/auth/token`EPSS 0.3%CVE-2026-47684HIGHSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPEPSS 0.2%CVE-2026-58271MEDIUM@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`EPSS 0.2%