CVE-2026-41161

Summary: CVE-2026-41161 affects Sync-in Server before version 2.2.0. The /api/auth/login endpoint exposes a timing-based flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring response times. This is confirmed in the GitHub advisory and CVE descriptions, which...

CVE-2025-56869

A directory traversal vulnerability exists in the Sync In server (versions through 1.1.1 ). The flaw is located within the FilesManager.saveMultipart and FilesManager.compress functions in backend/src/applications/files/services/files-manager.service.ts. This vulnerability allows authenticated at...

CVE-2025-67438

A Stored Cross-Site Scripting (XSS) vulnerability exists in Sync-in Server versions prior to 1.9.3 . An authenticated attacker can exploit this by uploading a crafted SVG file containing a malicious payload. This allows the execution of arbitrary JavaScript in a victim's browser, which can be use...