Read the docs
TI-2026-71799 Aliases CVE-2026-77375GHSA-q7pc-356p-hggc

Denial of service in SFTPGo via malformed SSH channel request

Priority LOW 29CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-129 and the CVSS impact.

Summary

SFTPGo versions before 2.7.5 are affected. An authenticated SSH user can send a malformed protocol message while opening a channel, and improper validation (CWE-129) leads to an unhandled error. The error terminates the server process, affecting all connected users until restart. No confidentiality or integrity impact has been identified.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed sftpgo (drakkan): 2.7.5github.com/drakkan/sftpgo/v2 (Go): 2.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
drakkansftpgobefore 2.7.52.7.5Patch availableCNA
—github.com/drakkan/sftpgo/v2 (Go)before 2.7.52.7.5Patch availableGHSA-q7pc-356p-hggc
  • sftpgo Vendordrakkan Affected before 2.7.5 Fixed in 2.7.5 Patch available CNA
  • github.com/drakkan/sftpgo/v2 (Go) Vendor— Affected before 2.7.5 Fixed in 2.7.5 Patch available GHSA-q7pc-356p-hggc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:*——drakkan
  • cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:* Versions — — ·drakkan

Remediation

Upgrade SFTPGo to version 2.7.5, which fixes this issue, for both the sftpgo product and the github.com/drakkan/sftpgo/v2 Go package.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA sftpgo (drakkan) Fixed in 2.7.5
  • Fix · GHSA-q7pc-356p-hggc github.com/drakkan/sftpgo/v2 (Go) Fixed in 2.7.5 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-77375
  2. 2026-10-16 Alias added: GHSA-q7pc-356p-hggc
  3. 2026-10-16 Fix available: Go/github.com/drakkan/sftpgo/[email protected] · GHSA-q7pc-356p-hggc
  4. 2026-10-16 CVSS score added · GHSA-q7pc-356p-hggc
  5. 2026-10-16 Weakness changed · GHSA-q7pc-356p-hggc
  6. 2026-10-16 5 new references · GHSA-q7pc-356p-hggc

References

Advisory 1

Other 4

  • TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2025-18109 Insufficient sanitization of user provided rsync command in SFTPGo CVSS 3.1HIGH 7.5
  • TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
  • TI-2026-36441 SFTPGo: Path confinement bypass in public browsable share partial ZIP download CVSS 3.1MEDIUM 5.9
  • TI-2026-23740 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy CVSS 4.0MEDIUM 5.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences