CVE-2026-112344— Syncplify Server! < 8.8.0 Symbolic Link Jail Escape

Quick assessment

Affected

Syncplify, Inc. Syncplify Server!

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Syncplify Server 8.8.0 之前的版本存在路径遍历漏洞。该漏洞允许攻击者在用户的主目录中放置符号链接，从而访问虚拟文件系统根目录之外的文件。这是因为系统的隔离机制仅对请求路径进行限制，而未对符号链接在磁盘上的实际目标路径进行校验。攻击者可利用指向隔离环境（jail）之外的符号链接（在 Windows 上为目录连接点），读取或访问超出预期主目录边界的受限文件。

CVSS 6.8 · Medium EPSS 0.30% · P22 Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1565.001 · Stored Data Manipulation T1083 · File and Directory Discovery

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Syncplify, Inc.	Syncplify Server!	`< 8.8.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Syncplify Server! < 8.8.0 Symbolic Link Jail Escape

Source: CVE Program / CVE List V5

Vulnerability Description

Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

Source: CVE Program / CVE List V5