CVE-2026-58270: Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern (e.g. ^(a+)+b) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sync-in Serverto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access to submit a request to the sync diff endpoint with a crafted pathFilters value. No user interaction is required.
What is the operational impact of successful exploitation?
A catastrophic-backtracking regular expression can block the Node.js event loop. This makes the entire server unresponsive to all users until the container is restarted.
Which deployments are affected?
Sync-in Server versions prior to 2.4.0 are affected if users with low privileges can reach the sync diff endpoint and supply pathFilters values.
What should be done if patching cannot happen immediately?
The provided information does not specify a workaround. Restricting access to the sync diff endpoint or preventing untrusted low-privileged users from supplying pathFilters may reduce exposure, but this is not documented as a complete mitigation.