CVE-2025-56869

5.3 mediumEPSS 0.7%

Medium (5.3) in sync-in sync-in server. EPSS 0.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in backend/src/applications/files/services/files-manager.service.ts.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-09-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sync-in:sync-in_server

References

https://github.com/Sync-in/server
https://github.com/Sync-in/server/releases/tag/v1.2.0
https://sync-in.com/

Check your stack JSON