Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service. The missing quotes around the binary path allow a local attacker to place a malicious executable in the directory referenced by the path. When the service restarts or the system reboots, the operating system resolves the path without quoting, executing the attacker‑deployed file with LocalSystem privileges. The resulting escalation grants the attacker complete control of the machine, including the ability to install rootkits, modify system settings, or create persistent backdoors.

The affected product is Syncplify.me Server!, version 5.0.37, available from Syncplify. The most recent publicly documented version susceptible to this flaw is 5.0.37. No other versions are listed as affected.

The CVSS score of 8.5 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no current widespread exploitation. This flaw is a local privilege escalation, relying on the presence of a local account with the ability to write to the service directory. Once the attacker can place a malicious executable, they can gain system‑level privileges with relatively simple steps, making the risk significant for systems where local user privileges are not tightly constrained.