{"id":"CVE-2026-127091","summary":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths","details":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.","modified":"2026-11-14T07:06:02.041967631Z","published":"2026-11-13T09:34:14.761Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-41"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127091.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"fixed":"3.0.33"},{"introduced":"3.1.0"},{"fixed":"3.1.7"},{"fixed":"1.8.1"}]}]},{"extracted_events":[{"range":[{"fixed":"3.0.33"},{"introduced":"3.1.x"},{"fixed":"3.1.7"},{"fixed":"1.8.1"}],"source":"DESCRIPTION"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127091.json"},{"type":"PACKAGE","url":"https://github.com/sshtools/maverick-synergy"},{"type":"ARTICLE","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219"},{"type":"FIX","url":"https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb"},{"type":"ADVISORY","url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127091"},{"type":"ADVISORY","url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"type":"ADVISORY","url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sshtools/maverick-synergy","events":[{"introduced":"0"},{"fixed":"f5531c21302d00901021bf2cb4dba7fca6436cfb"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"f5531c21302d00901021bf2cb4dba7fca6436cfb"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["3.0.10-SNAPSHOT","3.0.10","3.0.9","3.0.8","3.0.6","3.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127091.json","vanir_signatures":[{"id":"CVE-2026-127091-3865fe4f","signature_type":"Function","signature_version":"v1","source":"https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb","target":{"file":"maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java","function":"canonicalisePath"},"deprecated":false,"digest":{"function_hash":"85434204347280689320923202293894101228","length":594}},{"target":{"file":"maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java"},"deprecated":false,"digest":{"line_hashes":["177926894369343044962281833975866110631","280925546082448754936251726549780145005","88361513845305108017032454841007239397","256164627590461397157446778568657997055","174135115827321605688648560259149190926","296632240457193039721626246023267517993","208473677295071005981444236329111900427","179005075024264091116252265635161926989","178427834594225962447330962950779356920","270857723094995869530054474191080356098","165720032870949769400364214338474053937","189717564257952431351142309710587265647","336432051965783371881231496768126788584","193517568659385589119290474054170570947","263744515993660161224059393005427433110","330140498069723081612192298986620802945","272132583073391491613946702896445939829","319168070697817298062624851109054208636","173398692660012575576786985581116868255","84416198474857703644315234868259907958","238441097592047505846940780723277183877","137949115286666890662413501397550477963","157435458286709653658642339645277179503","28830115255999475511284434127175731206","70593076403916578846535294002505429277","4219760054196754052773221725983015395","155069029275467836171802985889269482533","227968821404598727892512757747009769538","104819521678132851459948494592617432824","56201263441069896672673524055220986454","102679676965385250994749875706714896133","305965041542341850661357732107435682329","338357094766151981026071335259552606886","132096444381642864291184390004628456614","143286185502542541792357539942356097935","234704859110723542252559213567698060418","267867727522904122710608102359618962103","222399130810806499310037974401623572360","197104480444084975764613823408435437894","216504194492586553140944773614591426602","204034720720081262632118264523485359136"],"threshold":0.9},"id":"CVE-2026-127091-bd781ac0","signature_type":"Line","signature_version":"v1","source":"https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb"}],"vanir_signatures_modified":"2026-11-14T07:06:02Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}