CVE-2026-112343

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

CVE-2026-112344

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk...

CVE-2026-112344 Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk...

CVE-2026-112344 Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk...

EUVD-2026-109967

Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination ...

CVE-2026-112344

Syncplify Server! versions before 8.8.0 are vulnerable to a path traversal vulnerability. The issue stems from improper link resolution where confinement is enforced only against the requested path rather than the on-disk destination. By placing a symbolic link (on Linux/Unix) or a directory junc...

CVE-2026-112343 Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

EUVD-2026-109966

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

CVE-2026-112343

Syncplify Server! versions prior to 8.8.0 are vulnerable to an access control bypass that allows authenticated SFTP users to evade per-path permission overrides. The root cause is the exploitation of case-insensitive filesystem path resolution and 8.3 short names , enabling attackers to access pr...

CVE-2026-112343 Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

PT-2026-123407

Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination ...

Syncplify Server backlink vulnerability

Versions of Syncplify Server prior to 8.8.0 contain a backlink vulnerability stemming from path traversal. Since only request paths are restricted without validation of the target file on disk, attackers can utilize symbolic links placed in users’ home directories or Windows directory links to re...

PT-2026-123406

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

Syncplify Server path traversal vulnerability

Versions prior to Syncplify Server 8.8.0 contain a path traversal vulnerability. This vulnerability stems from an access control bypass, allowing authenticated SFTP users to exploit case-insensitive file system path resolution and the 8.3 short filename feature to bypass per-path permissions. As ...

Syncplify Server code-related vulnerabilities

Syncplify Server is an FTP server provided by the Syncplify company. Version 5.0.37 of Syncplify Server has a code vulnerability. This vulnerability stems from an unreferenced service path within the SMWebRestServicev5 service. This could allow local attackers to exploit the unreferenced binary...