What it is
If a symbolic link (or, on Windows, a directory junction) pointing outside a VFS root already exists inside it, a user can follow it to reach files outside their home folder.
Affected
Versions 6.0.0 through 8.7.1, on Windows and Linux.
The advisory states “all versions before 8.8.0”; that is inaccurate and we have asked VulnCheck to correct it.
Are you exposed?
Only if such a link exists inside one of your VFS roots. Syncplify Server! users cannot create one unless you have explicitly granted them the permission to create symlinks (off by default). Otherwise, it must be created by someone or something with direct write access to that folder on disk.
Intentional links are not a vulnerability: if an administrator placed a link there on purpose, users reaching its target is the intended behavior.
Fix
Upgrade to v8.8.0 (released October 25, 2026).
It adds a per-user "Follow symlinks" setting: Always, Only if target lands inside of the user's root, or Never. It applies to Windows junctions too.After upgrading, every existing user is set to "Always" (same as before), so intentional links keep working.
For every user who should not follow links outside their root, change it to "Only if target lands inside of the user's root" or "Never".
If you keep "Always" for a user, make sure their permission to create symlinks is off, and check their root for links you didn't create:
Linux: find /path/to/vfs/root -type l
Windows: dir /AL /S C:\path\to\vfs\root
A note on intentional links
Some of our customers deliberately place symbolic links or directory junctions inside VFS roots to make better use of their storage. If a link was created on purpose by an administrator who knows where it points, that is not a vulnerability: it is a configuration choice and a useful feature.
Starting with v8.8.0, each user account has a “Follow symlinks” setting:
Always (same behavior as previous versions)
Only if target lands inside of the user’s root
Never
The default is Never for all newly created user profiles. If you rely on links that point outside a user’s root, set that user to Always after upgrading. When you do, make sure that user’s permission to create symlinks stays off: “Always” is safe only when every link in that root was placed there by you.
Advisory: https://www.vulncheck.com/advisories/syncplify-server-symbolic-link-jail-escape