CVE-2026-108555: Use of Less Trusted Source in schlagmichdoch PairDrop
Description
PairDrop versions up to 1.11.2 have an IP spoofing vulnerability in the Peer._setIP function. This flaw allows remote attackers to join discovery rooms of other networks by forging the cf-connecting-ip header. Attackers who know a victim's public IP can impersonate a local device on self-hosted instances that are not behind Cloudflare, enabling unauthorized file send/receive actions. The vulnerability has a low CVSS score of 2.3 and is rated as low severity. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.
CVSS v4.0
Score 2.3low
Affected software
schlagmichdoch
PairDrop
pkg:github/schlagmichdoch/PairDropRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108555 describes an IP spoofing vulnerability in PairDrop (up to version 1.11.2) within the Peer._setIP method. The vulnerability arises from trusting the cf-connecting-ip header, which can be forged by remote attackers. This allows them to join discovery rooms of other networks by appearing as local devices on self-hosted PairDrop instances not protected by Cloudflare. The flaw enables unauthorized participation in file sharing sessions. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial user interaction, no privileges required, and low impact on confidentiality and integrity. The vulnerability is patched, and the vendor manages remediation for the cloud service.
Potential Impact
Remote attackers can spoof IP addresses via the cf-connecting-ip header to join discovery rooms of other networks, potentially allowing unauthorized file transfers on self-hosted PairDrop instances not behind Cloudflare. The impact is limited due to the low CVSS score and the requirement of knowing the victim's public IP. No known exploits are reported in the wild.
Mitigation Recommendations
A patch is available for this vulnerability. Since PairDrop is a cloud service, the vendor manages remediation server-side. Users should ensure their instances are updated to a patched version and consider deploying behind Cloudflare or similar protections to mitigate IP spoofing risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-10T14:39:40.699Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6aca53de2cdf04f65634e498
Added to database: 10/10/2026, 15:03:58 UTC
Last enriched: 10/10/2026, 15:18:15 UTC
Last updated: 10/10/2026, 15:18:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.