Description
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.
Metrics
CVSS 3.1 6.8/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Jadaptive | Maverick Synergy Server | < 3.0.33; >= 3.1.0, < 3.1.7 |
| Jadaptive | Maverick Legacy Server | < 1.8.1 |
References
- https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219
- https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb
- https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002
- https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985
- https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4
- https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths
Timeline
- Published
- Nov 13, 2026
- Last modified
- Nov 13, 2026
- NVD status
- Awaiting Analysis