CVE-2017-1000420
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
- Record
CVE-2017-1000420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
- Record
CVE-2017-1000420- Updated
- 2026-11-02
EUVDEUVD-2022-1945 No score
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
- Record
EUVD-2022-1945- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-28xp-g7f6-7mhf
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.
- Record
GHSA-28xp-g7f6-7mhf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
- Record
CVE-2017-1000420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-1000420
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
- Record
DEBIAN-CVE-2017-1000420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-28xp-g7f6-7mhf
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.
- Record
GHSA-28xp-g7f6-7mhf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-1000420
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
- Record
UBUNTU-CVE-2017-1000420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/syncthing/syncthingGo |
through 0.14.33 | None known |
syncthingDebian:12 |
before 0.14.36+ds1-1 | 0.14.36+ds1-1 |
syncthingDebian:13 |
before 0.14.36+ds1-1 | 0.14.36+ds1-1 |
syncthingDebian:14 |
before 0.14.36+ds1-1 | 0.14.36+ds1-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000420 is a high vulnerability (CVSS 7.5) in Syncthing, published January 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in syncthing 0.14.36+ds1-1.
References
github.com/syncthing/syncthing/issues/4286
nvd.nist.gov/vuln/detail/CVE-2017-1000420
security-tracker.debian.org/tracker/CVE-2017-1000420
ubuntu.com/security/CVE-2017-1000420
cve.org/CVERecord?id=CVE-2017-1000420