| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/syncthing/syncthing | ≤ 0.14.33 | |
| syncthing | ≤ 0.14.33 |
Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free