EUVD-2026-37123

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses e.g. ::ffff:127.0.0.1, allowing SSRF protection to be bypassed ...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to validating the IPv4 as safe but then the request will be made to the unsafe IPv6 address, when a domain resolves to a public IPv4 and a private IPv6. PoC php enablePinDns; $pluginClient = new...