210 matches found
GHSA-M83Q-5WR4-4GFP SFTPGo improperly sanitizes placeholders in group home directories/key prefixes
Impact SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the...
EUVD-2026-12072
SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy...
SFTPGo 路径遍历漏洞
SFTPGo is a fully functional and highly configurable SFTP server developed by the Italian developer Nicola Murino. Versions of SFTPGo prior to 2.7.1 contained a path traversal vulnerability, which was caused by improper validation of dynamic group paths. This vulnerability could lead to path...
PT-2026-25355
Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.1 Description SFTPGo is an open source, event-driven file transfer solution. Versions of SFTPGo before 2.7.1 contain an input validation issue when handling dynamic group paths, such as home directories or key...
PT-2026-25354
Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.1 Description SFTPGo is an open-source, event-driven file transfer solution. A path normalization discrepancy exists between the protocol handlers and the internal Virtual Filesystem routing in versions prior to...
CVE-2026-30914: Improper Limitation of a Pathname to a Restricted Directory
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...
CVE-2026-30915: Improper Limitation of a Pathname to a Restricted Directory
SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...
SFTPGo 路径遍历漏洞
SFTPGo is a fully functional and highly configurable SFTP server developed by the Italian developer Nicola Murino. Versions of SFTPGo prior to 2.7.1 contained a path traversal vulnerability, which was caused by inconsistent path normalization, potentially leading to authorization bypasses...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: go-licenses, crossplane-provider-aws-elasticache, trino, kuma, podman, paranoia, crossplane-provider-aws-eks, crossplane-provider-aws-cloudwatchlogs, git-credential-oauth, step, gitsign, kube-vip-cloud-provider, aws-flb-cloudwatch, azure-ipam, envconsul, swagger,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: go-licenses, crossplane-provider-aws-elasticache, trino, kuma, podman, cargobump, paranoia, wireguard-go, crossplane-provider-aws-eks, crossplane-provider-aws-cloudwatchlogs, git-credential-oauth, step, gitsign, kube-vip-cloud-provider, aws-flb-cloudwatch, azure-ipam...
CVE-2025-67737: Missing Authorization
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a...
GHSA-9449-RPHM-MJQR AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
An API endpoint that is intended for internal use by the SFTP software sftpgo was mistakenly exposed to the public-facing HTTP API for AzuraCast installations. This would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the...
EUVD-2024-2079
Malicious code in bioql PyPI...
EUVD-2022-6779
Malicious code in bioql PyPI...
EUVD-2024-3341
Malicious code in bioql PyPI...
EUVD-2025-3680
Malicious code in bioql PyPI...
EUVD-2022-6703
Malicious code in bioql PyPI...
EUVD-2024-3435
Malicious code in bioql PyPI...