CVE-2026-112343
Received Received - Intake

Syncplify Server! Access Control Bypass via Case-Insensitive Path Resolution

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-112343
EUVD
EUVD-2026-109966

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Syncplify, Inc. Syncplify Server! 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-41 The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Syncplify Server! before version 8.8.0 has a permission override bypass vulnerability. Authenticated SFTP users can evade per-path permission restrictions by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can access protected directories by using alternate capitalization or the 8.3 short name of the directory, allowing unauthorized file uploads and downloads despite configured restrictions.

Detection Guidance

To detect this vulnerability, check if your Syncplify Server! version is below 8.8.0. Use the admin dashboard or run 'syncplify-server --version' to verify. Test for case-insensitive path bypasses by attempting to access protected directories with alternate capitalization or 8.3 short names via SFTP.

Impact Analysis

This vulnerability allows unauthorized users to bypass access controls and perform file operations on restricted directories. Attackers could read, modify, or delete sensitive files, leading to data breaches, unauthorized data exfiltration, or system compromise. The impact is high due to the potential for complete bypass of security controls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update Syncplify Server! to version 8.8.0 or later using the zero-downtime self-update feature or download from the official website. Review and tighten SFTP path-based permission configurations to ensure no alternate paths can bypass restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112343. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart