CVE-2026-127091
Received Received - Intake

Jadaptive Maverick Synergy Server Path Equivalence Flaw

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127091
EUVD
EUVD-2026-125092

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Jadaptive Maverick Synergy Server From 0 (inc) to 3.0.33 (exc)
Jadaptive Maverick Synergy Server From 3.1.0 (inc) to 3.1.7 (exc)
Jadaptive Maverick Legacy Server From 0 (inc) to 1.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-41 The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper path equivalence flaw in Jadaptive Maverick Synergy Server and Maverick Legacy Server. It allows authenticated users to bypass mount-level access policies by supplying paths with duplicate separators or dot segments. This tricks the system into routing operations to a less restrictive parent mount instead of the intended child mount, enabling unauthorized read or write access to files that should be protected.

Detection Guidance

To detect this vulnerability, check the version of your Jadaptive Maverick Synergy or Legacy Server. If running versions before 3.0.33, 3.1.x before 3.1.7, or Legacy Server before 1.8.1, the system is vulnerable. Review virtual filesystem mount configurations for nested or overlapping mounts where child mounts enforce stricter policies than parent mounts.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive files, leading to data breaches or unauthorized modifications. Attackers with valid credentials could read or write files outside their intended access scope, depending on the server's virtual filesystem configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, data exposure risks, and potential regulatory penalties if exploited.

Mitigation Strategies

Upgrade to the latest fixed versions of Jadaptive Maverick Synergy Server (3.0.33 or 3.1.7+) or Maverick Legacy Server (1.8.1+). Review and adjust virtual filesystem mount configurations to ensure child mounts are not backed by storage accessible through less restrictive parent mounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...