TI-2022-16494 CVE-2022-36071 · GHSA-54qx-8p8w-xhg8
Recovery codes abuse in SFTPGo
Priority HIGH 71
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support.
drakkan
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
drakkan records in CISA KEVNo drakkan vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
TI-2025-18109 CVE-2025-24366 · GHSA-vj7w-3m8c-6vpx
Insufficient sanitization of user provided rsync command in SFTPGo
Priority LOW 36
SFTPGo is an open source, event-driven file transfer solution.
TI-2026-71799 CVE-2026-77375 · GHSA-q7pc-356p-hggc
Denial of service in SFTPGo via malformed SSH channel request
Priority LOW 29
SFTPGo is an open source, event-driven file transfer solution.
TI-2022-18599 CVE-2022-39220 · GHSA-cf7g-cm7q-rq7f
XSS Vulnerabilities in WebClient
Priority LOW 28
SFTPGo is an SFTP server written in Go.
TI-2026-36441 CVE-2026-49244 · GHSA-h64p-8h4r-6gfh
SFTPGo: Path confinement bypass in public browsable share partial ZIP download
Priority LOW 27
SFTPGo is an open source, event-driven file transfer solution.
TI-2026-23740 CVE-2026-30914 · GHSA-x8qh-7475-c5mp
SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy
Priority LOW 25
SFTPGo is an open source, event-driven file transfer solution.
TI-2026-23741 CVE-2026-30915 · GHSA-m83q-5wr4-4gfp
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes
Priority LOW 24
SFTPGo is an open source, event-driven file transfer solution.
TI-2024-35314 CVE-2024-52801 · GHSA-6943-qr24-82vx
Brute force takeover of OpenID Connect session cookies in sftpgo
Priority LOW 24
sftpgo is a full-featured and highly configurable event-driven file transfer solution.
TI-2024-34984 CVE-2024-52309 · GHSA-49cc-xrjf-9qf7
SFTPGo allows administrators to restrict command execution from the EventManager
Priority LOW 24
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob.
TI-2024-25213 CVE-2024-37897 · GHSA-hw5f-6wvv-xcrh
Insufficient access control for password reset in sftpgo
Priority LOW 24
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob.
TI-2026-08791 CVE-2026-10031 · GHSA-3964-29ff-vwff
SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation
Priority LOW 23
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in dire…
TI-2026-71832 CVE-2026-103028 · GHSA-wwv9-g5x4-966q
SFTPGo copy operations bypass source file pattern filters
Priority LOW 19
SFTPGo is an open source, event-driven file transfer solution.
TI-2026-36442 CVE-2026-49245 · GHSA-3vcg-pv95-pq54
SFTPGo: Stored XSS via inline parameter on public shares and user file download
Priority LOW 17
SFTPGo is an open source, event-driven file transfer solution.