CVE-2026-112343

The record

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

Affected packages

Related vulnerabilities

• CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. CWE-41
• CVE-2026-110095 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. CWE-41
• CVE-2026-110725 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. CWE-41
• CVE-2026-70184 Improper resolution of path equivalence in Windows Backup Engine allows an authorized… CWE-41
• CVE-2026-102231 Improper resolution of path equivalence in Visual Studio Code allows an unauthorized… CWE-41
• CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Manager… CWE-41
• CVE-2026-72835 filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access… CWE-41
• CVE-2026-66064 goshs is a feature-rich single-binary file server for red teamers and developers. CWE-41