CVE-2026-47684CWE-918

Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

High · published June 16, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-16T14:31Z
EPSS history
Timeline
  • 16 JUN 14:31Z
    Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
    cvelistv5