Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Syncplify, Inc. | Syncplify Server! | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 26 Oct 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access. | |
| Title | Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing | |
| Weaknesses | CWE-41 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-26T15:54:12.544Z
Reserved: 2026-10-19T14:41:46.701Z
Link: CVE-2026-112343
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-26T16:17:13.797
Modified: 2026-10-26T16:17:13.797
Link: CVE-2026-112343
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-41
Improper Resolution of Path Equivalence