Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-112343Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

High 8.1

In plain English

A high-severity security flaw in Syncplify Server! from Syncplify, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

Affected products (as reported)

Vendor	Product	Versions
Syncplify, Inc.	Syncplify Server!	0 – before 8.8.0

Weakness: CWE-41 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Release Notes release-notes, patch
VulnCheck Advisory: Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing third-party-advisory