{"id":"CVE-2022-46165","aliases":["BIT-syncthing-2022-46165","DEBIAN-CVE-2022-46165","EUVD-2023-1766","GHSA-9rp6-23gf-4c3h","UBUNTU-CVE-2022-46165","openSUSE-SU-2023:0126-1","openSUSE-SU-2024:12984-1"],"status":"published","title":"Cross-site Scripting (XSS) in Web GUI in syncthing","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00778,"percentile":0.56201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-06-06T16:39:57Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"Go","package":"github.com/syncthing/syncthing","fixed_in":["1.23.5"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"syncthing","fixed_in":["1.23.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"syncthing","fixed_in":["1.27.2~ds4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"syncthing","fixed_in":["1.27.2~ds4-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"syncthing","fixed_in":["1.23.5-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"syncthing","fixed_in":["1.23.5-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"syncthing","fixed_in":["1.23.5-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/syncthing/syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"syncthing","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.2~ds1-1","1.19.2~ds1-2","1.19.2~ds1-3","1.27.2~ds4-1","1.27.7~ds1-1","1.27.7~ds1-2","1.27.7~ds1-3","1.27.7~ds1-4","1.27.7~ds1-5","1.29.2~ds1-1","1.29.5~ds1-1","1.29.5~ds1-2","1.29.5~ds1-3","1.29.5~ds1-4","1.29.5~ds1-5"]},{"source":"osv","ecosystem":"Debian:13","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2~ds4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2~ds4-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/syncthing/syncthing","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.36+ds1-1","0.14.38+ds1-1","0.14.43+ds1-5","0.14.43+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.4~ds1-4","1.1.4~ds1-4ubuntu1","1.1.4~ds1-4ubuntu1.1","1.1.4~ds1-4ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.1~ds1-4","1.18.0~ds1-3","1.18.0~ds1-3ubuntu0.1","1.18.0~ds1-3ubuntu0.2","1.18.0~ds1-3ubuntu0.3","1.18.0~ds1-3ubuntu0.3+esm1","1.18.0~ds1-3ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.2~ds1-3","1.27.2~ds4-1","1.27.2~ds4-1ubuntu0.24.04.1","1.27.2~ds4-1ubuntu0.24.04.2","1.27.2~ds4-1ubuntu0.24.04.2+esm1","1.27.2~ds4-1ubuntu0.24.04.3","1.27.2~ds4-1ubuntu0.24.04.3+esm1","1.27.2~ds4-1ubuntu0.24.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.2~ds1-1","1.29.5~ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.5~ds1-3","1.29.5~ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.5~ds1-2","1.29.5~ds1-3","1.29.5~ds1-3ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.5-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.5-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"syncthing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.5-1.1"}]}]}],"products":[{"vendor":"syncthing","product":"syncthing"}],"references":[{"url":"https://github.com/syncthing/syncthing/security/advisories/GHSA-9rp6-23gf-4c3h","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/syncthing/syncthing/commit/73c52eafb6566435dffd979c3c49562b6d5a4238","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRYGBFJPVBW6PPTETNIBWQJE4HJSA5PJ/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEBWSQVGHSTR4ZO7LVVEMPEGMV2DS5XR/","tags":["x_transferred","web"]},{"url":"https://github.com/syncthing/syncthing/commit/f5e5af391a6583047c64ef8c51642003a79b75cf","tags":["web"]},{"url":"https://github.com/syncthing/syncthing/releases/tag/v1.23.5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46165","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9rp6-23gf-4c3h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46165.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-46165","tags":["advisory"]},{"url":"https://github.com/syncthing/syncthing","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRYGBFJPVBW6PPTETNIBWQJE4HJSA5PJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEBWSQVGHSTR4ZO7LVVEMPEGMV2DS5XR","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-46165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46165","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FSIGQKHWF6QOVLGHNMHBJX6N46RVSK5D/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212085","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46165","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-46165","title":"Cross-site Scripting (XSS) in Web GUI in syncthing","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2023-06-06T17:59:30.857Z","modified":"2025-02-13T16:33:45.35Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2023-1766","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2023-06-06T17:59:30Z","modified":"2025-02-13T16:33:45Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:52.297177Z"}],"ghsa":[{"id":"GHSA-9rp6-23gf-4c3h","title":"syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI","description":"## Impact\n\n1. A compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name.\nIf the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically.\n\n2. Adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page.\n\n## Risk\n\nAs long as trusted devices are used, the risk is low.\nAdditionally, the web GUI is not used that often in daily use which reduces the likelihood of exploitation.\n\n## Details\n\n### 1. Field \"Latest Change\"\n\n* Open the web GUI at [http://127.0.0.1:8384/](http://127.0.0.1:8384/).\n* Create/Delete a file named ```\u003cimg src=a onerror=alert(123)\u003e``` and sync it to the other instance.\n* Move your mouse over the latest change to trigger the tooltip.\n\n\u003cimg width=\"834\" alt=\"latest-change\" src=\"https://user-images.githubusercontent.com/9484134/205084362-20a8ec13-a88d-469f-bdf1-e5291c20f4c1.png\"\u003e\n\n##### Web browser source\n```html\n\u003cspan tooltip=\"\" data-original-title=\"\\\u0026quot;\u003e\u003cimg src=a onerror=alert(123)\u003e @ 2022-11-30 16:58:43\"\n    aria-describedby=\"tooltip409527\"\u003e\n    \u003c!-- ngIf: !folderStats[folder.id].lastFile.deleted --\u003e\u003cspan translate=\"\"\n        translate-value-file=\"\u0026quot;\u003e\u003cimg src=a onerror=alert(123)\u003e\" ng-if=\"!folderStats[folder.id].lastFile.deleted\"\n        class=\"ng-scope\"\u003eUpdated \"\u0026gt;\u0026lt;img src=a onerror=alert(123)\u0026gt;\u003c/span\u003e\n    \u003c!-- end ngIf: !folderStats[folder.id].lastFile.deleted --\u003e\n    \u003c!-- ngIf: folderStats[folder.id].lastFile.deleted --\u003e\n\u003c/span\u003e\n\u003cdiv class=\"tooltip fade top in\" role=\"tooltip\" id=\"tooltip409527\"\n    style=\"top: 446.033px; left: 318.3px; display: block;\"\u003e\n    \u003cdiv class=\"tooltip-arrow\" style=\"left: 50%;\"\u003e\u003c/div\u003e\n    \u003cdiv class=\"tooltip-inner\"\u003e\\\"\u0026gt;\u003cimg src=\"a\" onerror=\"alert(123)\"\u003e @ 2022-11-30 16:58:43\u003c/div\u003e\n\u003c/div\u003e\n```\n\n##### Corresponding code in the project \n\nFile ````gui/default/index.html````:\n```html\n\u003ctr ng-if=\"folder.type != 'sendonly' \u0026\u0026 folder.type != 'receiveencrypted' \u0026\u0026 folderStats[folder.id].lastFile \u0026\u0026 folderStats[folder.id].lastFile.filename\"\u003e\n    \u003cth\u003e\u003cspan class=\"fas fa-fw fa-exchange-alt\"\u003e\u003c/span\u003e\u0026nbsp;\u003cspan translate\u003eLatest Change\u003c/span\u003e\u003c/th\u003e\n    \u003ctd class=\"text-right\"\u003e\n        \u003cspan tooltip data-original-title=\"{{folderStats[folder.id].lastFile.filename}} @ {{folderStats[folder.id].lastFile.at | date:'yyyy-MM-dd HH:mm:ss'}}\"\u003e\n        \u003cspan translate translate-value-file=\"{{folderStats[folder.id].lastFile.filename | basename}}\" ng-if=\"!folderStats[folder.id].lastFile.deleted\"\u003eUpdated {%file%}\u003c/span\u003e\n        \u003cspan translate translate-value-file=\"{{folderStats[folder.id].lastFile.filename | basename}}\" ng-if=\"folderStats[folder.id].lastFile.deleted\"\u003eDeleted {%file%}\u003c/span\u003e\n        \u003c/span\u003e\n    \u003c/td\u003e\n\u003c/tr\u003e\n```\n\nFile ````gui/default/syncthing/core/tooltipDirective.js````:  \n```javascript\nangular.module('syncthing.core')\n    .directive('tooltip', function () {\n        return {\n            restrict: 'A',\n            link: function (scope, element, attributes) {\n                $(element).tooltip({\n                    html: 'true'\n                });\n            }\n        };\n    });\n```\n\nThe attribute ```html``` should not be set to ```true``` or input sanitized.\n\n### 2. Field \"Shared With\"\n\n* Open the web GUI at [http://127.0.0.1:8384/](http://127.0.0.1:8384/).\n* Create a device with the following name ```fedora 1\"'\u003e\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e```.\n* Add the device to another instance and share a folder.\n* Move your mouse over the malicious device name to trigger the tooltip.\n \n\u003cimg width=\"608\" alt=\"shared-with-1\" src=\"https://user-images.githubusercontent.com/9484134/205084172-8cab2d0e-3257-46d5-be81-41fbd7228e0c.png\"\u003e\n\n\n##### Web browser source  \n\n```html\n\u003cspan tooltip=\"\" data-original-title=\"fedora 1\u0026quot;'\u003e\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e  \"\n    ng-bind-html=\"sharesFolder(folder)\" class=\"ng-binding\" aria-describedby=\"tooltip348410\"\u003efedora 1\"'\u0026gt;\u003ch1\u003eHeadline\n    \u003c/h1\u003e\u003cimg src=\"x\"\u003e\u003c/span\u003e\n\u003cdiv class=\"tooltip fade top\" role=\"tooltip\" id=\"tooltip348410\" style=\"top: 0px; left: 0px; display: block;\"\u003e\n    \u003cdiv class=\"tooltip-arrow\" style=\"left: 50%;\"\u003e\u003c/div\u003e\n    \u003cdiv class=\"tooltip-inner\"\u003efedora 1\"'\u0026gt;\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=\"x\"\u003e\n        \u003cscript\u003ealert(1)\u003c/script\u003e\n    \u003c/div\u003e\n\u003c/div\u003e\n```\n\n##### Corresponding code in the project \n\nFile ````gui/default/index.html````:\n\n```html\n\u003ctr\u003e\n    \u003cth\u003e\u003cspan class=\"fas fa-fw fa-share-alt\"\u003e\u003c/span\u003e\u0026nbsp;\u003cspan translate\u003eShared With\u003c/span\u003e\u003c/th\u003e\n    \u003ctd class=\"text-right\"\u003e\n        \u003cspan tooltip data-original-title=\"{{sharesFolder(folder)}} {{folderHasUnacceptedDevices(folder) ? '\u003cbr/\u003e(\u003csup\u003e1\u003c/sup\u003e' + ('The remote device has not accepted sharing this folder.' | translate) + ')' : ''}} {{folderHasPausedDevices(folder) ? '\u003cbr/\u003e(\u003csup\u003e2\u003c/sup\u003e' + ('The remote device has paused this folder.' | translate) + ')' : ''}}\" ng-bind-html=\"sharesFolder(folder)\"\u003e\u003c/span\u003e\n    \u003c/td\u003e\n\u003c/tr\u003e\n```\n\nFile ````gui/default/syncthing/core/tooltipDirective.js````:  \n\n```javascript\nangular.module('syncthing.core')\n    .directive('tooltip', function () {\n        return {\n            restrict: 'A',\n            link: function (scope, element, attributes) {\n                $(element).tooltip({\n                    html: 'true'\n                });\n            }\n        };\n    });\n```\n\nThe attribute ```html``` should not be set to ```true``` or input sanitized.\n\n##### HTML Injection in \"Edit Folder\"\n\n\u003cimg width=\"672\" alt=\"shared-with-2\" src=\"https://user-images.githubusercontent.com/9484134/205084067-b33f8536-e350-4de1-86f6-3d4a12a683c3.png\"\u003e\n","status":"published","published":"2023-06-06T16:39:57Z","modified":"2023-11-05T05:02:52Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:13.301199Z"}],"nvd":[{"id":"CVE-2022-46165","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2023-06-06T18:15:10.1Z","modified":"2026-06-17T05:11:20.607Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:38.721429Z"}],"osv":[{"id":"CVE-2022-46165","title":"Cross-site Scripting (XSS) in Web GUI in syncthing","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2023-06-06T17:59:30.857Z","modified":"2026-10-28T02:30:47.259159958Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-46165","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2023-06-06T18:15:10.1Z","modified":"2026-11-03T08:03:42.24715873Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:24.826312Z"},{"id":"GHSA-9rp6-23gf-4c3h","title":"syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI","description":"## Impact\n\n1. A compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name.\nIf the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically.\n\n2. Adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page.\n\n## Risk\n\nAs long as trusted devices are used, the risk is low.\nAdditionally, the web GUI is not used that often in daily use which reduces the likelihood of exploitation.\n\n## Details\n\n### 1. Field \"Latest Change\"\n\n* Open the web GUI at [http://127.0.0.1:8384/](http://127.0.0.1:8384/).\n* Create/Delete a file named ```\u003cimg src=a onerror=alert(123)\u003e``` and sync it to the other instance.\n* Move your mouse over the latest change to trigger the tooltip.\n\n\u003cimg width=\"834\" alt=\"latest-change\" src=\"https://user-images.githubusercontent.com/9484134/205084362-20a8ec13-a88d-469f-bdf1-e5291c20f4c1.png\"\u003e\n\n##### Web browser source\n```html\n\u003cspan tooltip=\"\" data-original-title=\"\\\u0026quot;\u003e\u003cimg src=a onerror=alert(123)\u003e @ 2022-11-30 16:58:43\"\n    aria-describedby=\"tooltip409527\"\u003e\n    \u003c!-- ngIf: !folderStats[folder.id].lastFile.deleted --\u003e\u003cspan translate=\"\"\n        translate-value-file=\"\u0026quot;\u003e\u003cimg src=a onerror=alert(123)\u003e\" ng-if=\"!folderStats[folder.id].lastFile.deleted\"\n        class=\"ng-scope\"\u003eUpdated \"\u0026gt;\u0026lt;img src=a onerror=alert(123)\u0026gt;\u003c/span\u003e\n    \u003c!-- end ngIf: !folderStats[folder.id].lastFile.deleted --\u003e\n    \u003c!-- ngIf: folderStats[folder.id].lastFile.deleted --\u003e\n\u003c/span\u003e\n\u003cdiv class=\"tooltip fade top in\" role=\"tooltip\" id=\"tooltip409527\"\n    style=\"top: 446.033px; left: 318.3px; display: block;\"\u003e\n    \u003cdiv class=\"tooltip-arrow\" style=\"left: 50%;\"\u003e\u003c/div\u003e\n    \u003cdiv class=\"tooltip-inner\"\u003e\\\"\u0026gt;\u003cimg src=\"a\" onerror=\"alert(123)\"\u003e @ 2022-11-30 16:58:43\u003c/div\u003e\n\u003c/div\u003e\n```\n\n##### Corresponding code in the project \n\nFile ````gui/default/index.html````:\n```html\n\u003ctr ng-if=\"folder.type != 'sendonly' \u0026\u0026 folder.type != 'receiveencrypted' \u0026\u0026 folderStats[folder.id].lastFile \u0026\u0026 folderStats[folder.id].lastFile.filename\"\u003e\n    \u003cth\u003e\u003cspan class=\"fas fa-fw fa-exchange-alt\"\u003e\u003c/span\u003e\u0026nbsp;\u003cspan translate\u003eLatest Change\u003c/span\u003e\u003c/th\u003e\n    \u003ctd class=\"text-right\"\u003e\n        \u003cspan tooltip data-original-title=\"{{folderStats[folder.id].lastFile.filename}} @ {{folderStats[folder.id].lastFile.at | date:'yyyy-MM-dd HH:mm:ss'}}\"\u003e\n        \u003cspan translate translate-value-file=\"{{folderStats[folder.id].lastFile.filename | basename}}\" ng-if=\"!folderStats[folder.id].lastFile.deleted\"\u003eUpdated {%file%}\u003c/span\u003e\n        \u003cspan translate translate-value-file=\"{{folderStats[folder.id].lastFile.filename | basename}}\" ng-if=\"folderStats[folder.id].lastFile.deleted\"\u003eDeleted {%file%}\u003c/span\u003e\n        \u003c/span\u003e\n    \u003c/td\u003e\n\u003c/tr\u003e\n```\n\nFile ````gui/default/syncthing/core/tooltipDirective.js````:  \n```javascript\nangular.module('syncthing.core')\n    .directive('tooltip', function () {\n        return {\n            restrict: 'A',\n            link: function (scope, element, attributes) {\n                $(element).tooltip({\n                    html: 'true'\n                });\n            }\n        };\n    });\n```\n\nThe attribute ```html``` should not be set to ```true``` or input sanitized.\n\n### 2. Field \"Shared With\"\n\n* Open the web GUI at [http://127.0.0.1:8384/](http://127.0.0.1:8384/).\n* Create a device with the following name ```fedora 1\"'\u003e\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e```.\n* Add the device to another instance and share a folder.\n* Move your mouse over the malicious device name to trigger the tooltip.\n \n\u003cimg width=\"608\" alt=\"shared-with-1\" src=\"https://user-images.githubusercontent.com/9484134/205084172-8cab2d0e-3257-46d5-be81-41fbd7228e0c.png\"\u003e\n\n\n##### Web browser source  \n\n```html\n\u003cspan tooltip=\"\" data-original-title=\"fedora 1\u0026quot;'\u003e\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e  \"\n    ng-bind-html=\"sharesFolder(folder)\" class=\"ng-binding\" aria-describedby=\"tooltip348410\"\u003efedora 1\"'\u0026gt;\u003ch1\u003eHeadline\n    \u003c/h1\u003e\u003cimg src=\"x\"\u003e\u003c/span\u003e\n\u003cdiv class=\"tooltip fade top\" role=\"tooltip\" id=\"tooltip348410\" style=\"top: 0px; left: 0px; display: block;\"\u003e\n    \u003cdiv class=\"tooltip-arrow\" style=\"left: 50%;\"\u003e\u003c/div\u003e\n    \u003cdiv class=\"tooltip-inner\"\u003efedora 1\"'\u0026gt;\u003ch1\u003eHeadline\u003c/h1\u003e\u003cimg src=\"x\"\u003e\n        \u003cscript\u003ealert(1)\u003c/script\u003e\n    \u003c/div\u003e\n\u003c/div\u003e\n```\n\n##### Corresponding code in the project \n\nFile ````gui/default/index.html````:\n\n```html\n\u003ctr\u003e\n    \u003cth\u003e\u003cspan class=\"fas fa-fw fa-share-alt\"\u003e\u003c/span\u003e\u0026nbsp;\u003cspan translate\u003eShared With\u003c/span\u003e\u003c/th\u003e\n    \u003ctd class=\"text-right\"\u003e\n        \u003cspan tooltip data-original-title=\"{{sharesFolder(folder)}} {{folderHasUnacceptedDevices(folder) ? '\u003cbr/\u003e(\u003csup\u003e1\u003c/sup\u003e' + ('The remote device has not accepted sharing this folder.' | translate) + ')' : ''}} {{folderHasPausedDevices(folder) ? '\u003cbr/\u003e(\u003csup\u003e2\u003c/sup\u003e' + ('The remote device has paused this folder.' | translate) + ')' : ''}}\" ng-bind-html=\"sharesFolder(folder)\"\u003e\u003c/span\u003e\n    \u003c/td\u003e\n\u003c/tr\u003e\n```\n\nFile ````gui/default/syncthing/core/tooltipDirective.js````:  \n\n```javascript\nangular.module('syncthing.core')\n    .directive('tooltip', function () {\n        return {\n            restrict: 'A',\n            link: function (scope, element, attributes) {\n                $(element).tooltip({\n                    html: 'true'\n                });\n            }\n        };\n    });\n```\n\nThe attribute ```html``` should not be set to ```true``` or input sanitized.\n\n##### HTML Injection in \"Edit Folder\"\n\n\u003cimg width=\"672\" alt=\"shared-with-2\" src=\"https://user-images.githubusercontent.com/9484134/205084067-b33f8536-e350-4de1-86f6-3d4a12a683c3.png\"\u003e\n","status":"published","published":"2023-06-06T16:39:57Z","modified":"2024-07-24T20:12:00.09317Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"UBUNTU-CVE-2022-46165","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2023-06-06T18:15:00Z","modified":"2026-10-17T12:56:22.814075682Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"BIT-syncthing-2022-46165","title":"Cross-site Scripting (XSS) in Web GUI in syncthing","description":"Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.","status":"published","published":"2024-07-24T19:38:31.354Z","modified":"2026-09-08T08:48:10.741948901Z","updated_at":"2026-11-02T15:28:35.51001Z"},{"id":"openSUSE-SU-2023:0126-1","title":"Security update for syncthing","description":"This update for syncthing fixes the following issues:\n\n- Update to 1.13.5\n\n  * This release fixes CVE-2022-46165 “Cross-site Scripting (XSS) in Web GUI”\n\n  * Bugfixes:\n\n    #8503: 'syncthing cli config devices add' reflect error when using --addresses flag\n    #8764: Ignore patterns creating during folder addition are not loaded\n    #8778: Tests fail on Windows with Go 1.20\n    #8779: Test cleanup fails all model tests on Windows on Go 1.20\n    #8859: Incorrect handling of path for auto accepted folder\n\n  * Other issues:\n\n    #8799: 'fatal error: checkptr: converted pointer straddles multiple allocations' in crypto tests\n\n- Update to 1.23.4\n\n  - Bugfixes:\n\n    #8851: 'Running global migration to fix encryption file sizes' on every start\n\n- Update to 1.23.3\n\n  * Bugfixes:\n\n    #5408: Selection of time in versions GUI not possible without editing the string inside the textfield\n    #8277: Mutual encrypted sharing doesn't work (both sides with password)\n    #8556: Increased file size when sharing between encrypted devices\n    #8599: Key generation at connect time is slow for encrypted connections\n\n  * Enhancements:\n\n    #7859: Allow sub-second watcher delay (use case: remote development)\n\n  * Other issues:\n\n    #8828: cmd/stdiscosrv: TestDatabaseGetSet flake\n\n- Adding a desktop file for the Web UI\n\n- Update to 1.23.2\n\n  * Bugfixes:\n\n    #8749: Relay listener does not restart sometimes\n\n  * Enhancements:\n\n    #8660: GUI editor for xattr filter patterns\n    #8781: gui: Remove duplicate Spanish translation\n\n  * Other issues:\n\n    #8768: Update quic-go for Go 1.20\n","status":"published","published":"2023-06-12T14:01:56Z","modified":"2026-02-04T04:23:47.744356Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12984-1","title":"syncthing-1.23.5-1.1 on GA media","description":"These are all security issues fixed in the syncthing-1.23.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:29.854155Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}