CVE-2026-127091

MEDIUM 6.8

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.

CWE	CWE-41
Vendor	jadaptive
Product	maverick synergy server
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for jadaptive maverick synergy server

Be the first to know when new medium vulnerabilities affecting jadaptive maverick synergy server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Jadaptive / Maverick Synergy Server

0 < 3.0.33 3.1.0 < 3.1.7

Jadaptive / Maverick Legacy Server

0 < 1.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

jadaptive.com: https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002 github.com: https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb store.jadaptive.com: https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985 store.jadaptive.com: https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4 github.com: https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219 vulncheck.com: https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths

Credits

Jadaptive Limited