SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy
Priority LOW 25CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix Fixed sftpgo (drakkan): 2.7.1github.com/drakkan/sftpgo/v2 (Go): 2.7.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| drakkan | sftpgo | before 2.7.1 | 2.7.1 | Patch available | CNA |
| — | github.com/drakkan/sftpgo/v2 (Go) | before 2.7.1 | 2.7.1 | Patch available | GHSA-x8qh-7475-c5mp |
| — | github.com/drakkan/sftpgo (Go) | up to 1.2.2 | — | No fix listed | GHSA-x8qh-7475-c5mp |
- sftpgo Vendordrakkan Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
- github.com/drakkan/sftpgo/v2 (Go) Vendor— Affected before 2.7.1 Fixed in 2.7.1 Patch available GHSA-x8qh-7475-c5mp
- github.com/drakkan/sftpgo (Go) Vendor— Affected up to 1.2.2 Fixed in — No fix listed GHSA-x8qh-7475-c5mp
Remediation
- Fix · CNA sftpgo (drakkan) Fixed in 2.7.1
- Fix · GHSA-x8qh-7475-c5mp github.com/drakkan/sftpgo/v2 (Go) Fixed in 2.7.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-30914
- 2026-10-03 Alias added: GHSA-x8qh-7475-c5mp
References
More drakkan Sftpgo vulnerabilities
- TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
- TI-2026-23741 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-30914 · CVE Program
- CVE-2026-30914 · NVD
- FIRST EPSS
- GHSA-x8qh-7475-c5mp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences