Syncplify Server! versions prior to 8.8.0 contain an access‑control bypass that allows an authenticated SFTP user to bypass per‑path permission overrides by leveraging case‑insensitive filesystem resolution and 8.3 short names. By referencing files or directories with alternate capitalization or their 8.3 short name, the user can upload or download files that the configured permission override intends to deny, leading to unauthorized access and potential data exfiltration. This vulnerability is a CWE‑41 flaw stemming from improper restriction of operations within directory limits.

The affected product is Syncplify Server! from Syncplify, Inc., any installation version older than 8.8.0. Specific versions are not listed beyond the pre‑8.8.0 threshold; the exploit can be applied to all releases before that milestone.

The vulnerability scores a CVSS of 8.6, indicating high severity. The EPSS is not disclosed, and the vulnerability is not yet in the CISA KEV catalog. Attackers need only authenticated SFTP access, which many users have, and the exploit requires no additional software. Because the bug is limited to path resolution, active exploitation is straightforward once credentials are obtained, giving attackers read/write privileges on protected files.