CVE-2026-112343

HighCVSS 8.1

Published: 26/10/2026(UTC)Updated: 31/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

41th percentile - higher than 41% of all known CVEs

Summary

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides using case-insensitive path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name.

Risk Assessment

An authenticated SFTP user can perform unauthorized file uploads and downloads in protected directories. This results in unauthorized file access.

Recommendation

Upgrade Syncplify Server! to version 8.8.0 or later. Until then, review permission override configuration and monitor access to protected directories.

Other vulnerabilities in Syncplify Server!

CVE-2026-112344Medium
Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers to place a symbolic link inside a user's home folder to access files outside the virtual filesystem root, because confinement is enforced only against the requested path and not the on-disk destination of the link.

Original NVD description (English source)

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS