CVE-2026-108555 schlagmichdoch CVE debrief

Who should care

Defenders of self-hosted PairDrop instances not behind Cloudflare should assess exposure and prioritize verification of the affected version. This includes reviewing current deployments, identifying potential entry points for attackers, and implementing compensating controls to detect and prevent IP spoofing attacks. Security teams should also monitor for suspicious activity and exception tracking to identify potential exploitation attempts.

Why it matters

The IP spoofing vulnerability in PairDrop allows remote attackers to join other networks' discovery rooms, potentially leading to unauthorized file transfer.

• Verify affected version and assess exposure on self-hosted instances not behind Cloudflare.
• Implement compensating controls to detect and prevent IP spoofing attacks.
• Monitor for suspicious activity and exception tracking.

Technical summary

The IP spoofing vulnerability in PairDrop allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files. This vulnerability is particularly relevant for self-hosted PairDrop instances not behind Cloudflare, as it could allow unauthorized file transfers. The vulnerability is confirmed in PairDrop version 1.11.2 and may affect earlier versions.

Defensive priority

Defenders should prioritize verifying the affected version and assessing exposure on self-hosted instances not behind Cloudflare.

Recommended defensive actions

• Verify the affected version of PairDrop and assess exposure on self-hosted instances not behind Cloudflare.
• Implement compensating controls to detect and prevent IP spoofing attacks.
• Monitor for suspicious activity and exception tracking.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the IP spoofing vulnerability in PairDrop. However, the corpus does not establish versions beyond 1.11.2, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.