CVE-2026-112344highCWE-59

CVE-2026-112344: fallo de gravedad alta en Syncplify Server!

Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Syncplify Server!

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.6epss 0.3%
Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
Syncplify, Inc. · Syncplify Server!
CVEs relacionadas — Syncplify Server!

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-112343HIGHSyncplify Server! < 8.8.0 Permission Override Bypass via Path CasingEPSS 0.5%CVE-2026-116844MEDIUMFclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT PEPSS 0.1%