Lucene search

K
osvGoogleOSV:GHSA-28XP-G7F6-7MHF
HistoryMay 14, 2022 - 3:49 a.m.

Syncthing vulnerable to symlink traversal and arbitrary file overwrite

2022-05-1403:49:59
Google
osv.dev
5
syncthing
symlink traversal
arbitrary file overwrite
version 0.14.33
software security

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

36.8%

Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

36.8%