CVE-2022-46165

CVE-2022-46165 is a stored cross-site scripting (XSS) vulnerability affecting Syncthing versions prior to 1.23.5. A compromised Syncthing instance could sync malicious files with embedded HTML/JavaScript in their names, or an attacker could add a device with a malicious name. If a user hovers over these elements in the web UI, the script could execute, potentially altering settings or adding devices. Rated as Medium severity (CVSS 5.4), this vulnerability requires user interaction (UI:R) and authenticated access (PR:L) to exploit, but can lead to changes in shared folder settings or device additions (I:L) and information disclosure (C:L). The attack vector is network-based (AV:N) with low attack complexity (AC:L). There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.