Access Control Bypass Vulnerability in Syncplify Server by Syncplify
CVE-2026-112343

8.6HIGH

Key Information:

Vendor

Syncplify, Inc.

Status
Syncplify Server!
Vendor
CVE Published:
26 October 2026

What is CVE-2026-112343?

An access control bypass vulnerability exists in Syncplify Server! prior to version 8.8.0. This flaw allows authenticated SFTP users to undermine established per-path permission checks. By leveraging case-insensitive filesystem path resolution and 8.3 short names, attackers can circumvent specified directory restrictions. This enables them to perform unauthorized uploads and downloads, compromising the intended security and integrity of file access controls.

Affected Version(s)

Syncplify Server! 0 < 8.8.0

References

https://blog.syncplify.com/p/syncplify-server-v880-released
release-notespatch
https://www.vulncheck.com/advisories/syncplify-server-per...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.