Vulnerabilities

TI-2026-23741 CVE-2026-30915 · GHSA-m83q-5wr4-4gfp

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

LOW 24

SFTPGo is an open source, event-driven file transfer solution.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00348 Published 2026-03-13 Fixed in 2.7.1 CWE-22

TI-2026-23740 CVE-2026-30914 · GHSA-x8qh-7475-c5mp

SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

LOW 25

SFTPGo is an open source, event-driven file transfer solution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00586 Published 2026-03-13 Fixed in 2.7.1 CWE-22

TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354

TI-2022-18599 CVE-2022-39220 · GHSA-cf7g-cm7q-rq7f

XSS Vulnerabilities in WebClient

LOW 28

SFTPGo is an SFTP server written in Go.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00637 Published 2022-09-20 Fixed in 2.3.5 CWE-79

TI-2022-16494 CVE-2022-36071 · GHSA-54qx-8p8w-xhg8

Recovery codes abuse in SFTPGo

HIGH 71

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00547 Published 2022-09-02 Fixed in 2.3.4 CWE-287