Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-112343

Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Syncplify
Products
Syncplify Server!
CVE-2026-112344

Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Syncplify
Products
Syncplify Server!
CVE-2020-37230

Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation

Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious executable into the service path and execute it with LocalSystem privileges when the service restarts or the system reboots.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Syncplify
Products
Syncplify.me Server!