CVE-2026-112344: Syncplify Server! < 8.8.0 Symbolic Link Jail Escape
Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Syncplify Server!to a version that resolves this vulnerability.Fixed in 8.8.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Syncplify Server! deployments before 8.8.0 are affected when an attacker can place a symbolic link inside a user's home folder. On Windows, a directory junction can be used in place of a symbolic link.
What access does an attacker need to exploit it?
The attacker needs low-level privileges and the ability to create or place a symlink in a user's home folder that points outside the virtual filesystem root. Exploitation does not require user interaction, but the attack complexity is high.
What is the recommended remediation?
Upgrade Syncplify Server! to version 8.8.0 or later. The affected versions are those before 8.8.0.