CVE catalog

CVE-2022-46165

syncthing: CVE-2022-46165

[CVE catalog]

Severity
Medium · CVSS 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.78% · Oct 25, 2026

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansyncthingsid1.29.5~ds1-5fixed
Debiansyncthingforky1.29.5~ds1-5fixed
Debiansyncthingtrixie1.29.5~ds1-2fixed
Debiansyncthingbookworm1.19.2~ds1-1vulnerable
Susesyncthingpackage hub 15 sp51.23.5-bp155.2.3.1fixed
Opensusesyncthingleap 15.51.23.5-bp155.2.3.1fixed
Opensusesyncthingtumbleweed1.23.5-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansyncthingsourcesid1.27.2~ds4-1not yet assignedNot reported[1037432]
Debiansyncthingsourceforky1.27.2~ds4-1not yet assignedNot reported[1037432]
Debiansyncthingsourcetrixie1.27.2~ds4-1not yet assignedNot reported[1037432]
Debiansyncthingsourcebookworm(unfixed)not yet assignedNot reported[1037432]
Susesyncthingrpmpackage hub 15 sp51.23.5-bp155.2.3.1Not reportedOPENSUSE-SU-2023:0126-1Not reported
Opensusesyncthingrpmleap 15.51.23.5-bp155.2.3.1Not reportedOPENSUSE-SU-2023:0126-1Not reported
Opensusesyncthingrpmtumbleweed1.23.5-1.1Not reportedOPENSUSE-SU-2024:12984-1Not reported

[Debian bug #1037432]

Notes

[bookworm] syncthing: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-syncthing-syncthing-dev]Affected

    Source package: [syncthing]

    Details (2)

    • 1.19.2~ds1-1 · all · bookworm

      Affected

      dsa · syncthing · debian · bookworm

    • 1.19.2~ds1-1 · all · bookworm

      Affected

      dsa · syncthing · debian · bookworm

  • [syncthing]Affected

    Source package: [syncthing]

    Details (2)

    • 1.19.2~ds1-1+b4 · amd64 · bookworm

      Affected

      dsa · syncthing · debian · bookworm

    • 1.19.2~ds1-1+b4 · arm64 · bookworm

      Affected

      dsa · syncthing · debian · bookworm

  • [syncthing-discosrv]Affected

    Source package: [syncthing]

    Details (2)

    • 1.19.2~ds1-1+b4 · amd64 · bookworm

      Affected

      dsa · syncthing · debian · bookworm

    • 1.19.2~ds1-1+b4 · arm64 · bookworm

      Affected

      dsa · syncthing · debian · bookworm

  • [syncthing-relaysrv]Affected

    Source package: [syncthing]

    Details (2)

    • 1.19.2~ds1-1+b4 · amd64 · bookworm

      Affected

      dsa · syncthing · debian · bookworm

    • 1.19.2~ds1-1+b4 · arm64 · bookworm

      Affected

      dsa · syncthing · debian · bookworm

[openSUSE Tumbleweed]

  • [syncthing-relaysrv]Unknown

    Source package: [syncthing]

    Details (1)

    • 2.1.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.5-1.1

      Version impact unknown

      dsa · syncthing · opensuse · tumbleweed

  • [syncthing]Fixed

    Source package: [syncthing]

    Details (1)

    • 2.1.3-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.23.5-1.1

      dsa · syncthing · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]