cyfenced.com →

[ CVE-2026-108555 · Published 10 Oct 2026 ]

Vulnerability in schlagmichdoch PairDrop

CVSS 4.2 EPSS <1%No fix listed yet

[ Description ]Official description

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References