---
id: CVE-2026-112344
title: Syncplify Server! < 8.8.0 Symbolic Link Jail Escape
summary: >-
  Syncplify Server! before 8.8.0 contains a path traversal vulnerability that
  allows attackers with a symbolic link placed inside a user's home folder to
  access files outside the virtual filesystem root because confinement is
  enforced only…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-59
vendor: 'Syncplify, Inc.'
product: Syncplify Server!
affected:
  - syncplify_server < 8.8.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:56:29.273Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112344'
references:
  - url: 'https://blog.syncplify.com/p/syncplify-server-v880-released'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/syncplify-server-symbolic-link-jail-escape
    label: 'VulnCheck Advisory: Syncplify Server! < 8.8.0 Symbolic Link Jail Escape'
tags:
  - cve.org
ingestedAt: '2026-10-26T16:31:40.064Z'
---

## Overview

Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

## Affected

- `syncplify_server < 8.8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.