Syncplify Server! EUVD-2026-109966

Requires (1) a valid authenticated SFTP account on Syncplify Server! before 8.8.0 (PR:L - not remote-unauthenticated), and (2) a per-path permission override configured to deny access to a specific directory, which is the control being bypassed; without such an override there is nothing to evade. The bypass is performed by addressing the protected directory via alternate capitalization or its 8.3 short name, so it depends on the underlying filesystem being case-insensitive and/or generating 8.3 short names (a Windows/NTFS characteristic) - on a strictly case-sensitive filesystem without short-name generation the technique is limited. Limiting factors: no anonymous/unauthenticated path, and impact is confined to directories the override was meant to protect.

Signals are moderately consistent and point to a real but conditional priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H) correctly reflects a network-reachable flaw that requires an authenticated SFTP account (PR:L) and yields both unauthorized reads and writes of protected paths; the 8.6 score is driven by that dual confidentiality/integrity impact, not by unauthenticated access. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with the absence of a CISA KEV listing and the absence of any EPSS value in the input. No EPSS score, no SSVC automatable/technical-impact breakdown, and no POC were supplied, so exploitation likelihood cannot be quantified from the data. The practical risk ceiling is set by two prerequisites the description makes explicit: the attacker must already hold valid SFTP credentials, and the server must actually use per-path permission overrides that the bypass can defeat. Note a scope caveat: 8.3 short-name resolution is a Windows/NTFS filesystem behavior, so the short-name half of the attack is platform-dependent - verify affected deployment OS with the vendor rather than assuming all installs are equally exposed.

An authenticated SFTP user who has been denied access to a sensitive directory via a per-path permission override requests that same directory using a different letter case or its 8.3 short name (e.g. the Windows short-name alias of the folder). Because path resolution is case-insensitive and resolves short names, the override check is bypassed and the user uploads to or downloads from the protected location. No public exploit code or PoC is identified in the provided data; exploitation requires only an existing low-privileged account and knowledge of the alternate path form.