{"id":"CVE-2026-108555","summary":"PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header","details":"PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.","modified":"2026-10-12T02:31:15.381486050Z","published":"2026-10-10T14:49:39.990Z","database_specific":{"cwe_ids":["CWE-348"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108555.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108555.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108555"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pairdrop-through-1.11.2-ip-spoofing-via-cf-connecting-ip-header"},{"type":"REPORT","url":"https://github.com/schlagmichdoch/PairDrop/issues/510"},{"type":"PACKAGE","url":"https://github.com/schlagmichdoch/PairDrop"},{"type":"ARTICLE","url":"https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/peer.js#L44-L54"},{"type":"ARTICLE","url":"https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/ws-server.js#L312-L314"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/schlagmichdoch/pairdrop","events":[{"introduced":"0"},{"fixed":"4862ba3067be1a0f2e0d1e94861dc9200b5bfeea"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.11.2"},{"fixed":"1.11.2"}]}}],"versions":["v1.11.1","v1.11.0","v1.10.11","v1.10.9","v1.10.8","v1.10.7","v1.10.6","v1.10.1","v1.9.2","v1.9.0","v1.9.1","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.3","v1.5.1","v1.5.2","v1.5.0","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.0","v1.4.1","v1.3.0","v1.2.2","v1.2.1","v1.2.0","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108555.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}