CVE-2026-127091: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jadaptive Maverick Synergy Serverto a version that resolves this vulnerability.Fixed in 3.0.33 - Upgrade
Upgrade
Jadaptive Maverick Synergy Serverto a version that resolves this vulnerability.Fixed in 3.1.7 - Upgrade
Upgrade
Maverick Legacy Serverto a version that resolves this vulnerability.Fixed in 1.8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it if the server's VFS mount configuration has a child mount with stricter access policy than an applicable parent mount.
What path forms are used to bypass the policy?
The bypass uses non-canonical paths containing duplicate separators or dot segments, causing operations to be routed to a less restrictive parent mount.
What is the potential impact on affected mount configurations?
An attacker may read or write files that the intended child mount policy denies.