CVE-2026-112344

MediumCVSS 6.8

Published: 26/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers to place a symbolic link inside a user's home folder to access files outside the virtual filesystem root, because confinement is enforced only against the requested path and not the on-disk destination of the link.

Risk Assessment

An attacker can read or access restricted files beyond the intended home-folder boundary, breaking user isolation and data confidentiality.

Recommendation

Update Syncplify Server! to version 8.8.0 or later, which properly enforces confinement against the link destination.

Other vulnerabilities in Syncplify Server!

CVE-2026-112343High
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides using case-insensitive path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name.

Original NVD description (English source)

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS