Read the docs
TI-2026-08791 Aliases CVE-2026-10031GHSA-3964-29ff-vwff

SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation

Priority LOW 23CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix Fixed SFTPGo (drakkan): 2.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
drakkanSFTPGobefore 2.7.42.7.4Patch availableCNA
  • SFTPGo Vendordrakkan Affected before 2.7.4 Fixed in 2.7.4 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:*——drakkan
  • cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:* Versions — — ·drakkan

Remediation

  • Fix · CNA SFTPGo (drakkan) Fixed in 2.7.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10031
  2. 2026-10-03 Alias added: GHSA-3964-29ff-vwff
  3. 2026-10-29 Title updated · CNA
  4. 2026-10-29 Affected versions changed · CNA

References

Advisory 1

Other 2

  • TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2025-18109 Insufficient sanitization of user provided rsync command in SFTPGo CVSS 3.1HIGH 7.5
  • TI-2026-71799 Denial of service in SFTPGo via malformed SSH channel request CVSS 3.1MEDIUM 6.5
  • TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
  • TI-2026-36441 SFTPGo: Path confinement bypass in public browsable share partial ZIP download CVSS 3.1MEDIUM 5.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences