CVE-2026-112343— Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Quick assessment

Affected

Syncplify, Inc. Syncplify Server!

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Syncplify Server 8.8.0 之前的版本存在一个访问控制绕过漏洞。该漏洞允许已认证的 SFTP 用户利用文件系统路径解析的“不区分大小写”特性以及 8.3 短文件名，规避按路径设置的权限覆盖规则。攻击者可以通过使用不同的字母大小写组合或目标受保护目录的 8.3 短名称来访问该目录，从而执行本应被配置规则禁止的文件上传和下载操作，最终导致未授权的文件访问。

CVSS 8.1 · High EPSS 0.47% · P41 Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Syncplify, Inc.	Syncplify Server!	`< 8.8.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Source: CVE Program / CVE List V5

Vulnerability Description

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

Source: CVE Program / CVE List V5