CVE-2026-3958 | Woahai321 ListSync up to 0.6.6 JSON api_server.py requests.post server-side request forgery (Issue 79)

A vulnerability identified as critical has been detected in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the component JSON Handler. The manipulation leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-3958. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.