CVE-2026-127091

Description

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.

References

• https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219
• https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb
• https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002
• https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985
• https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4