Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

PairDrop 1.11.2 can be tricked with a forged IP address

CVE-2026-108555 · published 8 days ago
Summary

The PairDrop file‑sharing tool up to version 1.11.2 can be fooled into thinking a request comes from a trusted network by sending a fake cf-connecting-ip header. An attacker who knows a victim's public IP could join the victim's private sharing room and exchange files without permission, especially on self‑hosted installations not protected by Cloudflare. Upgrade to a newer version or configure the server to reject or validate the cf-connecting-ip header to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
schlagmichdoch pairdrop <= 1.11.2
Original advisory text
PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-348Use of Less Trusted Source
Timeline
Published10 Oct 2026
Updated16 Oct 2026
First seen10 Oct 2026
Sources
CVE-2026-108555 · NVD
CVE-2026-108555 · MITRE
CVE-2026-108555 · OSV
Track software like this
Free during beta