We are happy to announce that we have just released a new version of our flagship software product, Syncplify Server!
What’s changed?
Fixed two yet-to-be-published CVEs (CVE-2026-112343 - Permission Override Bypass in Syncplify Server! Virtual Filesystem Path Matching and CVE-2026-112344 - Home Folder Escape via Symbolic Link Following in Syncplify Server!); we are grateful to the security researchers who found them for ethically abiding by the coordinated vulnerability disclosure principles, thus allowing us time to fix these two bugs before releasing their research which inherently explains how to exploit them… if there ever was a Syncplify Server! release you absolutely must update to, this is that release
The automatic self-update feature now also covers HA clusters in full, performing staggered updates of each node, using temporary leased tokens to guarantee uninterrupted availability of your file-transfer services throughout the entire update process
The live sessions data-table in the real-time dashboard now has a toggle for the operator to decide whether to keep it always in compact or expanded mode
More statistical information about each user activity is now displayed in the summary page of each user account in the Admin UI (very useful to the operator for troubleshooting)
Added a host of automation-related features, all of which had been highly requested by our customers, among which:
Automation tokens: unattended credentials for the SuperAdmin and Admin REST APIs. A token is minted by an operator who signed in with their second factor, belongs to that operator, is never broader than that operator’s own permissions, and can be narrowed further when it is created
Automation token security features:
tokens are read-only by default (writes must be enabled per token)
90-day expiration (can be increased to a maximum of 1 year
per-IP allow-list to control network origin of token usage
token can never create other tokens (an operator with 2FA is required)
automatic notification 7 days prior to token expiration
all write operations and mutations come with a
dry-runfeature
Complete automation audit trail: every change made with a token is recorded with the token and the operator who owns it; rejected token attempts and scope refusals are log events of their own
All mutations have been made idempotent, so that automation engines mistakenly running the same cycle more than once cannot cause unexpected results or instability
Optimistic concurrency: ETag on reads and If-Match on writes, so an automation agent never overwrites a change a human made in the meantime
Stable, machine readable reason codes in every error response, including authentication and permission refusals, documented in the manual with the guarantee that a code never changes its meaning
Bumped up the usual set of minor dependencies
As always, you can download the most recent release from our website. Or, if you are running any version from v8.2.0 (and up) you can use its built-in zero-downtime self-update feature directly from within the SuperAdmin UI.
Thank you all for trusting our software with your secure file transfers!