Syncplify Server! EUVD-2026-109967

Requires a valid low-privileged Syncplify Server account whose home folder permits the user to create a symbolic link or, on Windows, a directory junction, and the targeted sensitive files must exist on disk outside the virtual filesystem root. Exploitation is limited by the authentication requirement (PR:L - no anonymous access), by the need for the account/filesystem to allow link or junction creation inside the home folder, and by the attacker needing to know or guess a reachable out-of-jail path. It is not exploitable against a deployment where users cannot place links in their home directories or where no restricted files are reachable from the resolved destination.

Signals are mixed and point to a real-but-bounded priority rather than an emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N) and score of 7.6 describe a network-reachable flaw, but PR:L means a valid account is required and AC:H reflects dependence on successful link resolution, so this is not mass-exploitable against anonymous attackers. No EPSS score is provided in the input and the CVE is not on CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today 'this_week' priority and the fact that VulnCheck is the reporter indicate credible, recent coordinated disclosure rather than observed in-the-wild abuse. One internal conflict should be flagged: the vendor vector asserts VI:H (high integrity impact) while the description only states attackers can 'read or access' files outside the jail, which is a confidentiality-centric effect - whether the symlink escape also permits writes/overwrites beyond the boundary is not established by the available text and should be verified with the vendor. Net assessment: prioritize patching to v8.8.0 within the week for any multi-tenant Syncplify deployment where users can create links in their home folders, but this is a privilege-requiring, targeted-abuse issue, not a drive-by remote compromise.

A low-privileged but authenticated Syncplify Server user with write access to their own home folder creates a symbolic link (or, on Windows, a directory junction) that points to a sensitive location outside their virtual filesystem root. Because confinement is checked only against the requested path and not the on-disk destination the link resolves to, subsequent file requests through that link reach restricted files beyond the home-folder boundary. No confirmed working exploit code is identified in the input; a VulnCheck advisory documenting the jail escape exists.