CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...

GO-2026-5900 SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo

SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo...

GO-2026-5902 SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo

SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo...

PT-2026-55447

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.3 Description A stored Cross-Site Scripting XSS issue exists where the inline query parameter on the browsable-share file download and authenticated user file download endpoints suppresses the Content-Disposition:...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: ory-kratos, certificate-transparency-fips, ferretdb, seaweedfs, flyte, sftpgo-plugin-eventsearch, grafana-fips, wal-g, gotrue-fips, openbao-fips, hydra-fips, ldap2pg, temporal, pgwatch, harbor-fips, splunk-otel-collector, temporal-server-fips, gitlab-kas, grafana,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, spqr, cert-manager-csi-driver, zot, grafana, rancher-agent, seaweedfs, cert-manager, openbao, cert-manager-istio-csr, opentofu, minio, flux-source-controller, juicefs, sftpgo-plugin-auth, teleport, xeol, dex, external-secrets-operator...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, spqr, cert-manager-csi-driver, zot, grafana, rancher-agent, seaweedfs, cert-manager, openbao, cert-manager-istio-csr, opentofu, minio, flux-source-controller, juicefs, sftpgo-plugin-auth, teleport, xeol, dex, external-secrets-operator...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: ory-kratos, certificate-transparency-fips, ferretdb, seaweedfs, flyte, sftpgo-plugin-eventsearch, grafana-fips, wal-g, gotrue-fips, openbao-fips, hydra-fips, ldap2pg, temporal, pgwatch, harbor-fips, splunk-otel-collector, temporal-server-fips, gitlab-kas, grafana,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: malcontent, nodetaint, apko, pluto, actions-runner-controller, fluxcd-kustomize-mutating-webhook, sftpgo-plugin-eventsearch, goreleaser, mariadb-operator, rabbitmq-messaging-topology-operator, gh, oras, clickhouse-operator, karpenter, newrelic-k8s-metadata-injection,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: knative-client, kubernetes-event-exporter, jitsucom-bulker, spqr, x509-certificate-exporter, docker-credential-gcr, promxy, fscrypt, witness, juicefs-csi-driver, dapr, fuse-overlayfs-snapshotter, goreleaser, snyk-cli, spire-controller-manager, dask-gateway,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: crossplane, nerdctl, flyte, kube-arangodb, zarf-fips, spiffe-helper-fips, vault-secrets-operator, flux-kustomize-controller-fips, splunk-otel-collector, gitlab-runner-fips, kyverno-policy-reporter-fips, gitsign, chainctl-fips, trufflehog-fips, apko-fips,...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

SUSE CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

SUSE CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

GO-2026-4697 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo...

GO-2026-4699 SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo

SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...