Syncplify Server!: Access control bypass via path casing and 8.3 short names
Summary
Syncplify Server! before 8.8.0 contains an access control bypass that allows authenticated SFTP users to evade per-path permission overrides. An attacker can address a protected directory using alternate capitalization or its 8.3 short name and perform uploads and downloads that the override is meant to deny. The attacker needs a valid SFTP account, and the vendor's fix is included in version 8.8.0.
Affected
- Syncplify Server! versions before 8.8.0
Fixed in
- Syncplify Server! 8.8.0 (released October 25, 2026 by the vendor)
Workaround
- Unknown. The vendor documents no workaround; patching to 8.8.0 is the only documented fix.
- Third-party trackers suggest limiting SFTP access to trusted accounts and reviewing access to protected directories until the update is applied (not vendor-issued).
Exploitation
- No confirmed exploitation in the wild found.
- No public proof of concept found.
- CISA KEV: not checked directly; one aggregator lists it as not in KEV.
- EPSS: one aggregator lists 0.00472 (very low).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all Syncplify Server instances and their versions.
- Upgrade to 8.8.0 or later, prioritising internet-facing and partner-facing servers. Customers on 8.2.0 or later can use the built-in self-update.
- Until patched, limit SFTP accounts to trusted users and review access to protected directories.
- Check file access logs for unusual uploads or downloads to protected folders.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Syncplify Server! v8.8.0 release notes (vendor) blog.syncplify.com
- VulnCheck advisory CVE-2026-112343 www.vulncheck.com
- Feedly CVE-2026-112343 feedly.com
- Vulners CVE-2026-112343 vulners.com
- Red Packet Security CVE alert CVE-2026-112343 www.redpacketsecurity.com
- Syncplify download page www.syncplify.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:06.
Original description (NVD)
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.