Jadaptive Maverick Legacy Server/Maverick Synergy Server up to 1.8.0/3.0.32/3.1.6 Path Canonicalization VirtualFileFactory.canonicalisePath access control

Summaryinfo

A vulnerability classified as critical has been found in Jadaptive Maverick Legacy Server and Maverick Synergy Server up to 1.8.0/3.0.32/3.1.6. Affected by this vulnerability is the function VirtualFileFactory.canonicalisePath of the component Path Canonicalization. Performing a manipulation results in access control. This vulnerability was named CVE-2026-127091. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Jadaptive Maverick Legacy Server and Maverick Synergy Server up to 1.8.0/3.0.32/3.1.6. This affects the function VirtualFileFactory.canonicalisePath of the component Path Canonicalization. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies.

The advisory is shared at jadaptive.com. This vulnerability is uniquely identified as CVE-2026-127091 since 11/12/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 1.8.1, 3.0.33 or 3.1.7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Jadaptive

Name

• Maverick Legacy Server
• Maverick Synergy Server

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8.0
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.0.20
• 3.0.21
• 3.0.22
• 3.0.23
• 3.0.24
• 3.0.25
• 3.0.26
• 3.0.27
• 3.0.28
• 3.0.29
• 3.0.30
• 3.0.31
• 3.0.32
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion