CVE-2026-108555: PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Self-hosted PairDrop instances that are not behind Cloudflare are exposed. An attacker can exploit the issue to join discovery rooms associated with another network.
What does an attacker need to exploit it?
The attacker must be able to send a forged cf-connecting-ip header and know the victim network's public IP address. No authentication is required, but user interaction is required according to the supplied severity vector.
What could an attacker do after spoofing an IP address?
They can appear as a local device in the targeted network's discovery room and send or receive files with devices using that room.