CVE-2026-112344highCWE-59

CVE-2026-112344: falha de alta gravidade em Syncplify Server!

Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Syncplify Server!

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.3%
Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Syncplify, Inc. · Syncplify Server!
CVEs relacionadas — Syncplify Server!

No mesmo produto, das mais perigosas para as menos.

CVE-2026-112343HIGHSyncplify Server! < 8.8.0 Permission Override Bypass via Path CasingEPSS 0.5%CVE-2026-116844MEDIUMFclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT PEPSS 0.1%