{"id":"CVE-2026-127091","kind":"vulnerability","aliases":["CVE-2026-127091"],"related":[],"title":"Jadaptive Maverick Synergy: path tricks let users bypass folder access rules","description":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.","summary":"Jadaptive Maverick Synergy Server and Maverick Legacy Server fail to normalise file paths, so a logged-in user can send paths with duplicate separators or dot segments. Those paths route requests to a less restricted parent mount, letting the user read or write files that the child mount should deny.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","infrastructure","maverick-legacy","maverick-synergy","sftp"],"not_affected_if":["auth-required","single-mount-config"],"how_to_check":"- Check the installed Maverick Synergy Server version against the fixed ranges: `3.0.33` for the 3.0.x line and `3.1.7` for the 3.1.x line.\n- Check the installed Maverick Legacy Server version against `1.8.1`.\n- Review any mount-level access policies on the server, since the flaw bypasses them.","fix":"- Maverick Synergy Server 3.0.x: upgrade to `3.0.33` or later\n- Maverick Synergy Server 3.1.x: upgrade to `3.1.7` or later\n- Maverick Legacy Server: upgrade to `1.8.1` or later","status":"open","published_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:52:33+00:00","updated_at":"2026-11-13T10:52:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:52:33Z","model":"claude-haiku-5-5","output":{"fix":"- Maverick Synergy Server 3.0.x: upgrade to `3.0.33` or later\n- Maverick Synergy Server 3.1.x: upgrade to `3.1.7` or later\n- Maverick Legacy Server: upgrade to `1.8.1` or later","reach":"network","title":"Jadaptive Maverick Synergy: path tricks let users bypass folder access rules","impact":"medium","summary":"Jadaptive Maverick Synergy Server and Maverick Legacy Server fail to normalise file paths, so a logged-in user can send paths with duplicate separators or dot segments. Those paths route requests to a less restricted parent mount, letting the user read or write files that the child mount should deny.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["maverick-synergy","maverick-legacy","sftp","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read or write files outside their mount","analyst_note":"","how_to_check":"- Check the installed Maverick Synergy Server version against the fixed ranges: `3.0.33` for the 3.0.x line and `3.1.7` for the 3.1.x line.\n- Check the installed Maverick Legacy Server version against `1.8.1`.\n- Review any mount-level access policies on the server, since the flaw bypasses them.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","single-mount-config"],"who_is_affected":"Exposure requires an authenticated account on a Maverick server that uses mount-level access policies, because the flaw lets a user with some access reach files in a parent mount. Teams running these servers with per-mount restrictions should treat them as affected until upgraded. Servers without nested mounts or with only one access level are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000811,"input_tokens":4660,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127091':14A,17A '-2026':13A,16A '1.8.1':96C '3.0.33':85C '3.1':87C '3.1.7':90C 'access':10A,110C 'authent':112C 'bypass':8A,106C 'child':76B,138C 'contain':97C 'cve':12A,15A 'deni':79B,140C 'dot':55B,121C 'duplic':52B,118C 'equival':101C 'fail':37B 'file':19B,40B,73B,136C 'file-transf':18B 'flaw':102C 'folder':9A 'improp':99C 'infrastructur':21B 'jadapt':1A,29B,80C 'legaci':24B,35B,93C 'less':63B,128C 'let':6A,67B 'level':109C 'log':45B 'logged-in':44B 'maverick':2A,23B,26B,30B,34B,81C,92C 'maverick-legaci':22B 'maverick-synergi':25B 'mount':66B,77B,108C,131C,139C 'mount-level':107C 'normalis':39B 'oper':125C 'parent':65B,130C 'path':4A,41B,50B,58B,100C,116C 'polici':111C 'read':70B,133C 'request':60B 'restrict':64B,129C 'rout':59B,124C 'rule':11A 'segment':56B,122C 'send':49B 'separ':53B,119C 'server':32B,36B,83C,94C 'sftp':28B 'suppli':115C 'synergi':3A,27B,31B,82C 'transfer':20B 'trick':5A 'user':7A,47B,69B,113C 'virtualfilefactory.canonicalisepath':104C 'write':72B,135C 'x':88C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires an authenticated account on a Maverick server that uses mount-level access policies, because the flaw lets a user with some access reach files in a parent mount. Teams running these servers with per-mount restrictions should treat them as affected until upgraded. Servers without nested mounts or with only one access level are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filetransfer","high","infrastructure","mavericklegacy","mavericksynergy","sftp"],"campaign_type":null,"search_a":"'-127091':14A,17A '-2026':13A,16A 'access':10A 'bypass':8A 'cve':12A,15A 'folder':9A 'jadapt':1A 'let':6A 'maverick':2A 'path':4A 'rule':11A 'synergi':3A 'trick':5A 'user':7A","search_b":"'child':76B 'deni':79B 'dot':55B 'duplic':52B 'fail':37B 'file':19B,40B,73B 'file-transf':18B 'infrastructur':21B 'jadapt':29B 'legaci':24B,35B 'less':63B 'let':67B 'log':45B 'logged-in':44B 'maverick':23B,26B,30B,34B 'maverick-legaci':22B 'maverick-synergi':25B 'mount':66B,77B 'normalis':39B 'parent':65B 'path':41B,50B,58B 'read':70B 'request':60B 'restrict':64B 'rout':59B 'segment':56B 'send':49B 'separ':53B 'server':32B,36B 'sftp':28B 'synergi':27B,31B 'transfer':20B 'user':47B,69B 'write':72B","search_c":"'1.8.1':96C '3.0.33':85C '3.1':87C '3.1.7':90C 'access':110C 'authent':112C 'bypass':106C 'child':138C 'contain':97C 'deni':140C 'dot':121C 'duplic':118C 'equival':101C 'file':136C 'flaw':102C 'improp':99C 'jadapt':80C 'legaci':93C 'less':128C 'level':109C 'maverick':81C,92C 'mount':108C,131C,139C 'mount-level':107C 'oper':125C 'parent':130C 'path':100C,116C 'polici':111C 'read':133C 'restrict':129C 'rout':124C 'segment':122C 'separ':119C 'server':83C,94C 'suppli':115C 'synergi':82C 'user':113C 'virtualfilefactory.canonicalisepath':104C 'write':135C 'x':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127091","severity":null,"published_at":"2026-11-13T10:18:05+00:00","modified_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145316,"url":"https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145317,"url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}