Insufficient access control for password reset in sftpgo
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| drakkan | sftpgo | 2.2.0 to before 2.6.1 | 2.6.1 | Patch available | CNA |
| — | github.com/drakkan/sftpgo/v2 (Go) | 2.2.0 to before 2.6.1 | 2.6.1 | Patch available | GHSA-hw5f-6wvv-xcrh |
- sftpgo Vendordrakkan Affected 2.2.0 to before 2.6.1 Fixed in 2.6.1 Patch available CNA
- github.com/drakkan/sftpgo/v2 (Go) Vendor— Affected 2.2.0 to before 2.6.1 Fixed in 2.6.1 Patch available GHSA-hw5f-6wvv-xcrh
Remediation
- Fix · CNA sftpgo (drakkan) Fixed in 2.6.1
- Fix · GHSA-hw5f-6wvv-xcrh github.com/drakkan/sftpgo/v2 (Go) Fixed in 2.6.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37897
- 2026-10-03 Alias added: GHSA-hw5f-6wvv-xcrh
References
Other 5
- https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh
- https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423
- https://github.com/drakkan/sftpgo/commit/3462bba3f41cbc75486474991b9e3ac1b5f1e583
- https://github.com/drakkan/sftpgo
- https://github.com/drakkan/sftpgo/releases/tag/v2.6.1
More drakkan vulnerabilities
- TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2025-18109 Insufficient sanitization of user provided rsync command in SFTPGo CVSS 3.1HIGH 7.5
- TI-2026-71799 Denial of service in SFTPGo via malformed SSH channel request CVSS 3.1MEDIUM 6.5
- TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
- TI-2026-36441 SFTPGo: Path confinement bypass in public browsable share partial ZIP download CVSS 3.1MEDIUM 5.9
Sources
- CVE-2024-37897 · CVE Program
- CVE-2024-37897 · NVD
- FIRST EPSS
- GHSA-hw5f-6wvv-xcrh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences