Live › vulnerability › CVE-2026-112344
Go to dashboardSyncplify Server! before 8.8.0 checks file access against the requested path but not where a symbolic link or Windows directory junction actually points. An attacker who can place such a link inside their home folder can read or access files outside that folder.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Servers running Syncplify Server before 8.8.0 where users can create or upload symbolic links or directory junctions inside their home folder. Deployments where users cannot create links, or that run a patched version, are not exposed. The sources do not say which platforms or default settings are most exposed beyond the Windows junction note.
No product ranges from the sources yet.
8.8.0 are affecteddir /AL on Windows or find <home> -type l on Linux8.8.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.
This page as .md · .json · in your agent: get_signal("CVE-2026-112344")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.