{"id":"EUVD-2026-37123","enisaUuid":"666e2684-9044-3117-98b6-f121a918ff74","description":"Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.","datePublished":"Jun 16, 2026, 2:31:30 PM","dateUpdated":"Jun 16, 2026, 5:10:12 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg\nhttps://github.com/Sync-in/server/releases/tag/v2.3.0\n","aliases":"CVE-2026-47684\nGHSA-q4x5-8cj6-52wg\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"652db1e4-b642-3ce1-a682-ddf7aea488ef","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 2.3.0"}],"enisaIdVendor":[{"id":"fd2f7735-3b9d-31bd-8558-93f8520a59f6","vendor":{"name":"Sync-in"}}],"enisaIdVulnerability":[{"id":"0bccb015-3094-3fa3-8f19-a2c699818ba8","vulnerability":{"id":"CVE-2026-47684","description":"Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.","datePublished":"Jun 16, 2026, 2:31:30 PM","dateUpdated":"Jun 16, 2026, 5:10:12 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg\nhttps://github.com/Sync-in/server/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-37123\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 1, 2026, 7:18:53 AM","vulnerabilityProduct":[{"id":"74dd52c6-c4e6-3754-a9c7-28bdc1016ace","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 2.3.0"}],"vulnerabilityVendor":[{"id":"d9b076ba-90d6-35d2-81ac-5f26060016d2","vendor":{"name":"Sync-in"}}]}},{"id":"76fbd5c5-26f2-349f-89ea-dd61a30e0d1f","vulnerability":{"id":"GHSA-q4x5-8cj6-52wg","description":"Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP","datePublished":"Jun 5, 2026, 4:34:59 PM","dateUpdated":"Jul 8, 2026, 5:36:17 PM","baseScore":0.0,"references":"https://github.com/Sync-in/server/security/advisories/GHSA-q4x5-8cj6-52wg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47684\nhttps://github.com/Sync-in/server\nhttps://github.com/Sync-in/server/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-37123\n","aliases":"CVE-2026-47684\nGHSA-q4x5-8cj6-52wg\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}