Syncplify Server! versions prior to 8.8.0 contain a path traversal flaw that allows an attacker who can place a symbolic link or, on Windows, a directory junction inside a user's home folder to read files located outside the intended virtual filesystem root. The confinement mechanism checks the requested path but not the actual on‑disk destination of the link, which means the attacker can bypass the intended home‑folder boundary and access restricted data. This weakness is a classic example of CWE‑59, where improperly sanitized paths can lead to unintended file discovery and disclosure.

The vulnerability affects all installations of Syncplify, Inc.’s Syncplify Server! software that are running a version earlier than 8.8.0. Any instance that allows a user to create symbolic links or directory junctions within their home directory is susceptible unless a newer release is deployed.

The CVSS score of 7.6 indicates that the flaw is moderately high in severity, with a significant impact on confidentiality. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation activity. However, the likely attack vector is local: a malicious actor who can write a symlink or junction in the target user's home directory can trigger the bypass. If an attacker can gain such local write access—through compromised credentials, social engineering, or a separate privilege escalation—the exploitation is straightforward and does not require special configuration.