[{"uuid":"GSA_kwCzR0hTQS05cnA2LTIzZ2YtNGMzaM4AAzrz","url":"https://github.com/advisories/GHSA-9rp6-23gf-4c3h","title":"syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI","description":"## Impact\n\n1. A compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name.\nIf the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically.\n\n2. Adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page.\n\n## Risk\n\nAs long as trusted devices are used, the risk is low.\nAdditionally, the web GUI is not used that often in daily use which reduces the likelihood of exploitation.\n\n## Details\n\n### 1. Field \"Latest Change\"\n\n* Open the web GUI at [http://127.0.0.1:8384/](http://127.0.0.1:8384/).\n* Create/Delete a file named ```\u003cimg src=a onerror=alert(123)\u003e``` and sync it to the other instance.\n* Move your mouse over the latest change to trigger the tooltip.\n\n\u003cimg width=\"834\" alt=\"latest-change\" src=\"https://user-images.githubusercontent.com/9484134/205084362-20a8ec13-a88d-469f-bdf1-e5291c20f4c1.png\"\u003e\n\n##### Web browser source\n```html\n\u003cspan tooltip=\"\" data-original-title=\"\\\u0026quot;\u003e\u003cimg src=a onerror=alert(123)\u003e @ 2022-11-30 16:58:43\"\n    aria-describedby=\"tooltip409527\"\u003e\n    \u003c!-- ngIf: !folderStats[folder.id].lastFile.deleted --\u003e\u003cspan translate=\"\"\n        translate-value-file=\"\u0026quot;\u003e\u003cimg src=a onerror=alert(123)\u003e\" ng-if=\"!folderStats[folder.id].lastFile.deleted\"\n        class=\"ng-scope\"\u003eUpdated \"\u0026gt;\u0026lt;img src=a onerror=alert(123)\u0026gt;\u003c/span\u003e\n    \u003c!-- end ngIf: !folderStats[folder.id].lastFile.deleted --\u003e\n    \u003c!-- ngIf: folderStats[folder.id].lastFile.deleted --\u003e\n\u003c/span\u003e\n\u003cdiv class=\"tooltip fade top in\" role=\"tooltip\" id=\"tooltip409527\"\n    style=\"top: 446.033px; left: 318.3px; display: block;\"\u003e\n    \u003cdiv class=\"tooltip-arrow\" style=\"left: 50%;\"\u003e\u003c/div\u003e\n    \u003cdiv class=\"tooltip-inner\"\u003e\\\"\u0026gt;\u003cimg src=\"a\" onerror=\"alert(123)\"\u003e @ 2022-11-30 16:58:43\u003c/div\u003e\n\u003c/div\u003e\n```\n\n##### Corresponding code in the project \n\nFile ````gui/default/index.html````:\n```html\n\u003ctr ng-if=\"folder.type != 'sendonly' \u0026\u0026 folder.type != 'receiveencrypted' \u0026\u0026 folderStats[folder.id].lastFile \u0026\u0026 folderStats[folder.id].lastFile.filename\"\u003e\n    \u003cth\u003e\u003cspan class=\"fas fa-fw fa-exchange-alt\"\u003e\u003c/span\u003e\u0026nbsp;\u003cspan translate\u003eLatest Change\u003c/span\u003e\u003c/th\u003e\n    \u003ctd class=\"text-right\"\u003e\n        \u003cspan tooltip data-original-title=\"{{folderStats[folder.id].lastFile.filename}} @ {{folderStats[folder.id].lastFile.at | date:'yyyy-MM-dd HH:mm:ss'}}\"\u003e\n        \u003cspan translate translate-value-file=\"{{folderStats[folder.id].lastFile.filename | basename}}\" ng-if=\"!folderStats[folder.id].lastFile.deleted\"\u003eUpdated {%file%}\u003c/span\u003e\n        \u003cspan translate translate-value-file=\"{{folderStats[folder.id].lastFile.filename | basename}}\" ng-if=\"folderStats[folder.id].lastFile.deleted\"\u003eDeleted {%file%}\u003c/span\u003e\n        \u003c/span\u003e\n    \u003c/td\u003e\n\u003c/tr\u003e\n```\n\nFile ````gui/default/syncthing/core/tooltipDirective.js````:  \n```javascript\nangular.module('syncthing.core')\n    .directive('tooltip', function () {\n        return {\n            restrict: 'A',\n            link: function (scope, element, attributes) {\n                $(element).tooltip({\n                    html: 'true'\n                });\n            }\n        };\n    });\n```\n\nThe attribute ```html``` should not be set to ```true``` or input sanitized.\n\n### 2. Field \"Shared With\"\n\n* Open the web GUI at [http://127.0.0.1:8384/](http://127.0.0.1:8384/).\n* Create a device with the following name ```fedora 1\"'\u003e\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e```.\n* Add the device to another instance and share a folder.\n* Move your mouse over the malicious device name to trigger the tooltip.\n \n\u003cimg width=\"608\" alt=\"shared-with-1\" src=\"https://user-images.githubusercontent.com/9484134/205084172-8cab2d0e-3257-46d5-be81-41fbd7228e0c.png\"\u003e\n\n\n##### Web browser source  \n\n```html\n\u003cspan tooltip=\"\" data-original-title=\"fedora 1\u0026quot;'\u003e\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e  \"\n    ng-bind-html=\"sharesFolder(folder)\" class=\"ng-binding\" aria-describedby=\"tooltip348410\"\u003efedora 1\"'\u0026gt;\u003ch1\u003eHeadline\n    \u003c/h1\u003e\u003cimg src=\"x\"\u003e\u003c/span\u003e\n\u003cdiv class=\"tooltip fade top\" role=\"tooltip\" id=\"tooltip348410\" style=\"top: 0px; left: 0px; display: block;\"\u003e\n    \u003cdiv class=\"tooltip-arrow\" style=\"left: 50%;\"\u003e\u003c/div\u003e\n    \u003cdiv class=\"tooltip-inner\"\u003efedora 1\"'\u0026gt;\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=\"x\"\u003e\n        \u003cscript\u003ealert(1)\u003c/script\u003e\n    \u003c/div\u003e\n\u003c/div\u003e\n```\n\n##### Corresponding code in the project \n\nFile ````gui/default/index.html````:\n\n```html\n\u003ctr\u003e\n    \u003cth\u003e\u003cspan class=\"fas fa-fw fa-share-alt\"\u003e\u003c/span\u003e\u0026nbsp;\u003cspan translate\u003eShared With\u003c/span\u003e\u003c/th\u003e\n    \u003ctd class=\"text-right\"\u003e\n        \u003cspan tooltip data-original-title=\"{{sharesFolder(folder)}} {{folderHasUnacceptedDevices(folder) ? '\u003cbr/\u003e(\u003csup\u003e1\u003c/sup\u003e' + ('The remote device has not accepted sharing this folder.' | translate) + ')' : ''}} {{folderHasPausedDevices(folder) ? '\u003cbr/\u003e(\u003csup\u003e2\u003c/sup\u003e' + ('The remote device has paused this folder.' | translate) + ')' : ''}}\" ng-bind-html=\"sharesFolder(folder)\"\u003e\u003c/span\u003e\n    \u003c/td\u003e\n\u003c/tr\u003e\n```\n\nFile ````gui/default/syncthing/core/tooltipDirective.js````:  \n\n```javascript\nangular.module('syncthing.core')\n    .directive('tooltip', function () {\n        return {\n            restrict: 'A',\n            link: function (scope, element, attributes) {\n                $(element).tooltip({\n                    html: 'true'\n                });\n            }\n        };\n    });\n```\n\nThe attribute ```html``` should not be set to ```true``` or input sanitized.\n\n##### HTML Injection in \"Edit Folder\"\n\n\u003cimg width=\"672\" alt=\"shared-with-2\" src=\"https://user-images.githubusercontent.com/9484134/205084067-b33f8536-e350-4de1-86f6-3d4a12a683c3.png\"\u003e\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-06-06T16:39:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.6,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","references":["https://github.com/syncthing/syncthing/security/advisories/GHSA-9rp6-23gf-4c3h","https://github.com/syncthing/syncthing/commit/f5e5af391a6583047c64ef8c51642003a79b75cf","https://github.com/syncthing/syncthing/releases/tag/v1.23.5","https://nvd.nist.gov/vuln/detail/CVE-2022-46165","https://github.com/syncthing/syncthing/commit/73c52eafb6566435dffd979c3c49562b6d5a4238","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRYGBFJPVBW6PPTETNIBWQJE4HJSA5PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEBWSQVGHSTR4ZO7LVVEMPEGMV2DS5XR/","https://github.com/advisories/GHSA-9rp6-23gf-4c3h"],"source_kind":"github","identifiers":["GHSA-9rp6-23gf-4c3h","CVE-2022-46165"],"repository_url":"https://github.com/syncthing/syncthing","blast_radius":0.0,"created_at":"2023-06-06T17:03:22.842Z","updated_at":"2026-09-26T20:12:00.245Z","epss_percentage":0.00778,"epss_percentile":0.53543,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05cnA2LTIzZ2YtNGMzaM4AAzrz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05cnA2LTIzZ2YtNGMzaM4AAzrz","packages":[{"ecosystem":"go","package_name":"github.com/syncthing/syncthing","versions":[{"first_patched_version":"1.23.5","vulnerable_version_range":"\u003c 1.23.5"}],"purl":"pkg:go/github.com%2Fsyncthing%2Fsyncthing"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05cnA2LTIzZ2YtNGMzaM4AAzrz/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yOHhwLWc3ZjYtN21oZs4AAXir","url":"https://github.com/advisories/GHSA-28xp-g7f6-7mhf","title":"Syncthing vulnerable to symlink traversal and arbitrary file overwrite","description":"Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-14T03:49:59.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2017-1000420","https://github.com/syncthing/syncthing/issues/4286","https://github.com/syncthing/syncthing/commit/f1f21bf22020d9b881478c2e942ba6943c8da2f3","https://github.com/advisories/GHSA-28xp-g7f6-7mhf"],"source_kind":"github","identifiers":["GHSA-28xp-g7f6-7mhf","CVE-2017-1000420"],"repository_url":"https://github.com/syncthing/syncthing","blast_radius":0.0,"created_at":"2023-07-26T23:03:37.993Z","updated_at":"2026-09-24T15:12:14.265Z","epss_percentage":0.01509,"epss_percentile":0.73295,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOHhwLWc3ZjYtN21oZs4AAXir","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yOHhwLWc3ZjYtN21oZs4AAXir","packages":[{"ecosystem":"go","package_name":"github.com/syncthing/syncthing","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.14.33"}],"purl":"pkg:go/github.com%2Fsyncthing%2Fsyncthing"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOHhwLWc3ZjYtN21oZs4AAXir/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg0NjItODlwZi02cjVo","url":"https://github.com/advisories/GHSA-x462-89pf-6r5h","title":"Crash due to malformed relay protocol message","description":"### Impact\n\n1. `syncthing` can be caused to crash and exit if sent a malformed relay\n   protocol message message with a negative length field.\n\n2. The relay server `strelaysrv` can be caused to crash and exit if sent\n   a malformed relay protocol message with a negative length field.\n\nAt no point is sensitive data exposed or liable to be altered due to this\nissue. Sensitive data is never exposed to relay operators. Syncthing itself\nwould need to be lured to connect to a malicious relay server in order to\nexploit the issue.\n\n### Patches\n\nFixed in version 1.15.0.\n\n### Workarounds\n\n1. No known workaround for `strelaysrv`.\n\n2. `syncthing` can be configured to not use relays, or to only use specific,\n   trusted relays. If Syncthing is used in a closed environment or with\n   relaying disabled, i.e., it does not communicate with unknown relays,\n   Syncthing is not vulnerable.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).\n\nThanks to Wojciech Paciorek for discovering and reporting this issue.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2021-05-21T16:23:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h","https://nvd.nist.gov/vuln/detail/CVE-2021-21404","https://github.com/syncthing/syncthing/commit/fb4fdaf4c0a79c22cad000c42ac1394e3ccb6a97","https://github.com/syncthing/syncthing/releases/tag/v1.15.0","https://pkg.go.dev/github.com/syncthing/syncthing","https://github.com/advisories/GHSA-x462-89pf-6r5h"],"source_kind":"github","identifiers":["GHSA-x462-89pf-6r5h","CVE-2021-21404"],"repository_url":"https://github.com/syncthing/syncthing","blast_radius":0.0,"created_at":"2022-12-21T16:13:01.675Z","updated_at":"2026-09-26T20:14:38.012Z","epss_percentage":0.0197,"epss_percentile":0.79536,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg0NjItODlwZi02cjVo","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg0NjItODlwZi02cjVo","packages":[{"ecosystem":"go","package_name":"github.com/syncthing/syncthing","versions":[{"first_patched_version":"1.15.0","vulnerable_version_range":"\u003c 1.15.0"}],"purl":"pkg:go/github.com%2Fsyncthing%2Fsyncthing"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg0NjItODlwZi02cjVo/related_packages","related_advisories":[]}]