{"uuid": "c387aec7-5124-48a2-8db2-720814018579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108555", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417188089909882", "content": "CVE-2026-108555 PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108555https://github.com/schlagmichdoch/PairDrop/issues/510https://github.com/schlagmichdoch/PairDrophttps://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/peer.js#L44-L54https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/ws-server.js#L312-L314https://www.vulncheck.com/advisories/pairdrop-through-1.11.2-ip-spoofing-via-cf-connecting-ip-header#schlagmichdoch #PairDrop#CVE_2026_108555#bot", "creation_timestamp": "2026-10-10T14:55:07.123916Z"}