What is CVE-2026-112344?

CVE-2026-112344 is a medium-severity vulnerability, classified under Improper Link Resolution Before File Access. CVSS score: 6.8/10. Published 2026-10-26.

How severe is CVE-2026-112344?

Medium severity. CVSS v3 base score is 6.8 out of 10.

CVE-2026-112344

CVE-2026-112344

Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

Published 2026-10-26 · last modified 2026-10-26.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

blog.syncplify.com/p/syncplify-server-v880-released (release-notes, patch)
www.vulncheck.com/advisories/syncplify-server-symbolic-link-jail-escape (third-party-advisory)

Frequently asked questions

What is CVE-2026-112344?: CVE-2026-112344 is a medium-severity vulnerability, classified under Improper Link Resolution Before File Access. CVSS score: 6.8/10. Published 2026-10-26.
How severe is CVE-2026-112344?: Medium severity. CVSS v3 base score is 6.8 out of 10.