CVE-2026-127091 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Jadaptive Maverick Synergy Server and Maverick Legacy Server fail to normalise file paths, so a logged-in user can send paths with duplicate separators or dot segments. Those paths route requests to a less restricted parent mount, letting the user read or write files that the child mount should deny.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Exposure requires an authenticated account on a Maverick server that uses mount-level access policies, because the flaw lets a user with some access reach files in a parent mount. Teams running these servers with per-mount restrictions should treat them as affected until upgraded. Servers without nested mounts or with only one access level are less exposed.
Not affected if auth-required, single-mount-config
Who cares file-transfer, maverick-legacy, maverick-synergy, sftp
3.0.33 for the 3.0.x line and 3.1.7 for the 3.1.x line.1.8.1.3.0.33 or later3.1.7 or laterJadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.8.1NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.