EUVD-2026-51360

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...

GO-2026-5900 SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo

SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo...

GO-2026-5902 SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo

SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo...

PT-2026-55447

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.3 Description A stored Cross-Site Scripting XSS issue exists where the inline query parameter on the browsable-share file download and authenticated user file download endpoints suppresses the Content-Disposition:...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: authentik-fips, spicedb, rke2-runtime, temporal-server, azure-service-operator, chainloop-control-plane, goose-fips, juicefs, gitlab-cng, amass, cloudprober-fips, ory-kratos, openbao, sqlexporter, spicedb-fips, splunk-otel-collector-fips, peerdb-flow, seaweedfs,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: rclone, zot, telegraf, frp, openbao, sftpgo-plugin-auth, gitea, rancher, teleport, yunikorn-k8shim, cert-manager, kyverno, flux-source-controller, opentofu, xeol, ratify, trufflehog, grafana, seaweedfs, flux, cert-manager-csi-driver, minio, external-secrets-operator,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: rclone, zot, telegraf, frp, openbao, sftpgo-plugin-auth, gitea, rancher, teleport, yunikorn-k8shim, cert-manager, kyverno, flux-source-controller, opentofu, xeol, ratify, trufflehog, grafana, seaweedfs, flux, cert-manager-csi-driver, minio, external-secrets-operator,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: authentik-fips, spicedb, rke2-runtime, temporal-server, azure-service-operator, chainloop-control-plane, goose-fips, juicefs, gitlab-cng, amass, cloudprober-fips, ory-kratos, openbao, sqlexporter, spicedb-fips, splunk-otel-collector-fips, peerdb-flow, seaweedfs,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: stakater-reloader, temporal, go, karpenter, grafana-operator, clickhouse-operator, mountpoint-s3-csi-driver, newrelic-infra-operator, secrets-store-csi-driver-provider-aws, nodetaint, oras, smarter-device-manager, victoriametrics, flux-source-controller,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rancher-machine, snyk-cli, trivy-operator, karpenter, k8ssandra-client, temporal-ui-server, openbao, terraform-provider-random, cluster-api-provider-vsphere, certificate-transparency, argocd-image-updater, wal-g, sftpgo-plugin-eventstore, kyverno, cis-operator,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller-fips, rabbitmq-messaging-topology-operator, neuvector-sigstore-interface, authentik-fips, frp, kyverno-policy-reporter-plugins-kyverno, livekit-egress, flux-source-controller, zarf, octo-sts, cloudprober-fips, kyverno-fips, openbao,...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

SUSE CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

SUSE CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

GO-2026-4697 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo...

GO-2026-4699 SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo

SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...