Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Maverick Synergy Server by Jadaptive
CVE-2026-127091 (GCVE-0-2026-127091)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths
Summary
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.
Severity
CWE
- CWE-41 - Improper Resolution of Path Equivalence
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://jadaptive.com/security/advisories/JADAPTI… | vendor-advisory |
| https://github.com/sshtools/maverick-synergy/comm… | patch |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://github.com/sshtools/maverick-synergy/blob… | technical-description |
| https://www.vulncheck.com/advisories/jadaptive-ma… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Jadaptive | Maverick Synergy Server |
Affected:
0 , < 3.0.33
(semver)
Affected: 3.1.0 , < 3.1.7 (semver) |
|
| Jadaptive | Maverick Legacy Server |
Affected:
0 , < 1.8.1
(semver)
|
Date Public
2026-10-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.sshtools/maverick-virtual-filesystem",
"product": "Maverick Synergy Server",
"repo": "https://github.com/sshtools/maverick-synergy",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "3.0.33",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Maverick Legacy Server",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "1.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jadaptive Limited"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-41",
"description": "Improper Resolution of Path Equivalence",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:14.761Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb"
},
{
"name": "Maverick Synergy Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"
},
{
"name": "Maverick Legacy Server Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219"
},
{
"name": "VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths"
}
],
"title": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-127091",
"datePublished": "2026-11-13T09:34:14.761Z",
"dateReserved": "2026-11-12T14:18:16.983Z",
"dateUpdated": "2026-11-13T09:34:14.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-127090 (GCVE-0-2026-127090)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:25
VLAI
EPSS
VEX
Title
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass
Summary
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 18:24 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://jadaptive.com/security/advisories/JADAPTI… | vendor-advisory |
| https://github.com/sshtools/maverick-synergy/comm… | patch |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://github.com/sshtools/maverick-synergy/blob… | technical-description |
| https://github.com/sshtools/maverick-synergy/blob… | technical-description |
| https://www.vulncheck.com/advisories/jadaptive-ma… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Jadaptive | Maverick Synergy Server |
Affected:
0 , < 3.0.33
(semver)
Affected: 3.1.0 , < 3.1.7 (semver) |
|
| Jadaptive | Maverick Legacy Server |
Affected:
0 , < 1.8.1
(semver)
|
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-127090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T18:24:36.800035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:25:56.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.sshtools/maverick-synergy-server",
"product": "Maverick Synergy Server",
"repo": "https://github.com/sshtools/maverick-synergy",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "3.0.33",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Maverick Legacy Server",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "1.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jadaptive Limited"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:15.399Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"
},
{
"name": "Maverick Synergy Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"
},
{
"name": "Maverick Legacy Server Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"
},
{
"name": "VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"
}
],
"title": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-127090",
"datePublished": "2026-11-13T09:34:15.399Z",
"dateReserved": "2026-11-12T14:18:09.726Z",
"dateUpdated": "2026-11-13T18:25:56.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-127090 (GCVE-0-2026-127090)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:25
VLAI
EPSS
VEX
Title
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass
Summary
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 18:24 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://jadaptive.com/security/advisories/JADAPTI… | vendor-advisory |
| https://github.com/sshtools/maverick-synergy/comm… | patch |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://github.com/sshtools/maverick-synergy/blob… | technical-description |
| https://github.com/sshtools/maverick-synergy/blob… | technical-description |
| https://www.vulncheck.com/advisories/jadaptive-ma… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Jadaptive | Maverick Synergy Server |
Affected:
0 , < 3.0.33
(semver)
Affected: 3.1.0 , < 3.1.7 (semver) |
|
| Jadaptive | Maverick Legacy Server |
Affected:
0 , < 1.8.1
(semver)
|
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-127090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T18:24:36.800035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:25:56.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.sshtools/maverick-synergy-server",
"product": "Maverick Synergy Server",
"repo": "https://github.com/sshtools/maverick-synergy",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "3.0.33",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Maverick Legacy Server",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "1.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jadaptive Limited"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:15.399Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"
},
{
"name": "Maverick Synergy Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"
},
{
"name": "Maverick Legacy Server Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"
},
{
"name": "VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"
}
],
"title": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-127090",
"datePublished": "2026-11-13T09:34:15.399Z",
"dateReserved": "2026-11-12T14:18:09.726Z",
"dateUpdated": "2026-11-13T18:25:56.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-127091 (GCVE-0-2026-127091)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths
Summary
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.
Severity
CWE
- CWE-41 - Improper Resolution of Path Equivalence
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://jadaptive.com/security/advisories/JADAPTI… | vendor-advisory |
| https://github.com/sshtools/maverick-synergy/comm… | patch |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://store.jadaptive.com/app/api/releases/chan… | release-notes |
| https://github.com/sshtools/maverick-synergy/blob… | technical-description |
| https://www.vulncheck.com/advisories/jadaptive-ma… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Jadaptive | Maverick Synergy Server |
Affected:
0 , < 3.0.33
(semver)
Affected: 3.1.0 , < 3.1.7 (semver) |
|
| Jadaptive | Maverick Legacy Server |
Affected:
0 , < 1.8.1
(semver)
|
Date Public
2026-10-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.sshtools/maverick-virtual-filesystem",
"product": "Maverick Synergy Server",
"repo": "https://github.com/sshtools/maverick-synergy",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "3.0.33",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Maverick Legacy Server",
"vendor": "Jadaptive",
"versions": [
{
"lessThan": "1.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jadaptive Limited"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-41",
"description": "Improper Resolution of Path Equivalence",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:14.761Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb"
},
{
"name": "Maverick Synergy Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"
},
{
"name": "Maverick Legacy Server Release Notes",
"tags": [
"release-notes"
],
"url": "https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219"
},
{
"name": "VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths"
}
],
"title": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-127091",
"datePublished": "2026-11-13T09:34:14.761Z",
"dateReserved": "2026-11-12T14:18:16.983Z",
"dateUpdated": "2026-11-13T09:34:14.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}