CVE-2026-127091

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-127091
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127091.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-127091
Published
2026-11-13T09:34:14Z
Modified
2026-11-14T07:06:02Z
Severity
  • 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths
Details

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-41"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127091.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "3.0.33"
                        },
                        {
                            "introduced": "3.1.0"
                        },
                        {
                            "fixed": "3.1.7"
                        },
                        {
                            "fixed": "1.8.1"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "3.0.33"
                        },
                        {
                            "introduced": "3.1.x"
                        },
                        {
                            "fixed": "3.1.7"
                        },
                        {
                            "fixed": "1.8.1"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/sshtools/maverick-synergy

Affected ranges

Type
GIT
Repo
https://github.com/sshtools/maverick-synergy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f5531c21302d00901021bf2cb4dba7fca6436cfb
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "f5531c21302d00901021bf2cb4dba7fca6436cfb"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0.10
3.0.10-SNAPSHOT
3.0.5
3.0.6
3.0.8
3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127091.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85434204347280689320923202293894101228",
            "length": 594
        },
        "id": "CVE-2026-127091-3865fe4f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb",
        "target": {
            "file": "maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java",
            "function": "canonicalisePath"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177926894369343044962281833975866110631",
                "280925546082448754936251726549780145005",
                "88361513845305108017032454841007239397",
                "256164627590461397157446778568657997055",
                "174135115827321605688648560259149190926",
                "296632240457193039721626246023267517993",
                "208473677295071005981444236329111900427",
                "179005075024264091116252265635161926989",
                "178427834594225962447330962950779356920",
                "270857723094995869530054474191080356098",
                "165720032870949769400364214338474053937",
                "189717564257952431351142309710587265647",
                "336432051965783371881231496768126788584",
                "193517568659385589119290474054170570947",
                "263744515993660161224059393005427433110",
                "330140498069723081612192298986620802945",
                "272132583073391491613946702896445939829",
                "319168070697817298062624851109054208636",
                "173398692660012575576786985581116868255",
                "84416198474857703644315234868259907958",
                "238441097592047505846940780723277183877",
                "137949115286666890662413501397550477963",
                "157435458286709653658642339645277179503",
                "28830115255999475511284434127175731206",
                "70593076403916578846535294002505429277",
                "4219760054196754052773221725983015395",
                "155069029275467836171802985889269482533",
                "227968821404598727892512757747009769538",
                "104819521678132851459948494592617432824",
                "56201263441069896672673524055220986454",
                "102679676965385250994749875706714896133",
                "305965041542341850661357732107435682329",
                "338357094766151981026071335259552606886",
                "132096444381642864291184390004628456614",
                "143286185502542541792357539942356097935",
                "234704859110723542252559213567698060418",
                "267867727522904122710608102359618962103",
                "222399130810806499310037974401623572360",
                "197104480444084975764613823408435437894",
                "216504194492586553140944773614591426602",
                "204034720720081262632118264523485359136"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127091-bd781ac0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb",
        "target": {
            "file": "maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:06:02Z"