TI-2024-34984 Aliases CVE-2024-52309 GHSA-49cc-xrjf-9qf7

SFTPGo allows administrators to restrict command execution from the EventManager

LOW 24CWE-20Published 2024-11-21 · Updated 2024-11-21

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in response to certain events. This feature is very common in all software similar to SFTPGo and is generally unrestricted. However, any SFTPGo administrator with permission to run a script has access to the underlying OS/container with the same permissions as the user running SFTPGo. This is unexpected for some SFTPGo administrators who think that there is a clear distinction between accessing the system shell and accessing the SFTPGo WebAdmin UI. To avoid this confusion, running system commands is disabled by default in 2.6.3, and an allow list has been added so that system administrators configuring SFTPGo must explicitly define which commands are allowed to be configured from the WebAdmin UI.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0063 50th percentileScored 2026-11-07

Fix Fixed sftpgo (drakkan): 2.6.3github.com/drakkan/sftpgo/v2 (Go): 2.6.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
drakkan	sftpgo	2.4.0 to before 2.6.3	2.6.3	Patch available	CNA
—	github.com/drakkan/sftpgo/v2 (Go)	2.4.0 to before 2.6.3	2.6.3	Patch available	GHSA-49cc-xrjf-9qf7
—	sftpgo (Go)	2.4.0 to before 2.6.3	2.6.3	Patch available	GHSA-49cc-xrjf-9qf7

sftpgo Vendordrakkan Affected 2.4.0 to before 2.6.3 Fixed in 2.6.3 Patch available CNA
github.com/drakkan/sftpgo/v2 (Go) Vendor— Affected 2.4.0 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-49cc-xrjf-9qf7
sftpgo (Go) Vendor— Affected 2.4.0 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-49cc-xrjf-9qf7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:sftpgo_project:sftpgo::::::::	—	—	drakkan

cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:* Versions — — ·drakkan

Remediation

Fix · CNA sftpgo (drakkan) Fixed in 2.6.3
Fix · GHSA-49cc-xrjf-9qf7 github.com/drakkan/sftpgo/v2 (Go) Fixed in 2.6.3 Advisory →
Fix · GHSA-49cc-xrjf-9qf7 sftpgo (Go) Fixed in 2.6.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-52309
2026-10-03 Alias added: GHSA-49cc-xrjf-9qf7
2026-10-28 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-52309

Other 5

TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
TI-2025-18109 Insufficient sanitization of user provided rsync command in SFTPGo CVSS 3.1HIGH 7.5
TI-2026-71799 Denial of service in SFTPGo via malformed SSH channel request CVSS 3.1MEDIUM 6.5
TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
TI-2026-36441 SFTPGo: Path confinement bypass in public browsable share partial ZIP download CVSS 3.1MEDIUM 5.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences