Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Old Syncthing Software Can Delete Any File on Your Computer

CVE-2017-1000420 · published 8 years ago
Summary

Syncthing versions older than 0.14.33 have a security weakness that could allow attackers to delete any file on your computer. This could happen if you're sharing files with someone you don't fully trust. To fix this, update Syncthing to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
go github.com syncthing <= 0.14.33
– syncthing syncthing <= 0.14.33
cpe:2.3:a:syncthing:syncthing:*:*:*:*:*:*:*:*
Original advisory text
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published2 Jan 2018
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-28xp-g7f6-7mhf · GHSA
CVE-2017-1000420 · NVD
Track software like this
Free during beta