CVE-2026-47684

{
  "id": "CVE-2026-47684",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-16T15:16:41.063",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Sync-in Server es una plataforma segura de código abierto para almacenamiento de archivos, compartición, colaboración y sincronización. Antes de la versión 2.3.0, la expresión regular de la lista de bloqueo de IP privadas utilizada en la función de descarga de URL no coincide con las direcciones IPv6 mapeadas a IPv4 (p. ej. ::ffff:127.0.0.1), permitiendo que la protección SSRF sea eludida en sistemas de doble pila. La versión 2.3.0 soluciona el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Sync-in",
          "product": "server",
          "versions": [
            {
              "version": "< 2.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T17:01:38.857420Z",
          "id": "CVE-2026-47684",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Sync-in/server/releases/tag/v2.3.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}