GHSA-c2vr-5g2g-3597HighCVSS 6.8
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy...
🔗 CVE IDs covered (1)
📋 Description
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-127091
- https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb
- https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219
- https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002
- https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985
- https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4
- https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths
- https://github.com/advisories/GHSA-c2vr-5g2g-3597