high7.5
CVE-2017-1000420
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Impact
Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/syncthing/syncthing | <= 0.14.33 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Syncthing | Syncthing | through 0.14.33 |