162 matches found
EUVD-2026-51360
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...
CVE-2026-10031
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...
CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...
GO-2026-5900 SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo
SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo...
GO-2026-5902 SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo
SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo...
PT-2026-55447
Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.3 Description A stored Cross-Site Scripting XSS issue exists where the inline query parameter on the browsable-share file download and authenticated user file download endpoints suppresses the Content-Disposition:...
CVE-2026-41889 vulnerabilities
Vulnerabilities for packages: gitness, gotrue, opentelemetry-collector-contrib-fips, harbor-fips, steampipe, keda-fips, step-ca, ory-kratos, temporal, gotrue-fips, k3s, gitlab-kas, grafana-alloy-fips, ldap2pg, openfga, seaweedfs, vault-fips, seaweedfs-rocksdb-fips, openbao,...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: flux, external-secrets-operator, rancher-agent, teleport, grafana, dex, minio, kyverno, spqr, rclone, gitea, cert-manager-cmctl, bento, rancher, trufflehog, k6, zot, juicefs, seaweedfs, flux-source-controller, yunikorn-k8shim, xeol, frp, telegraf, terraform,...
GHSA-PJCQ-XVWQ-HHPJ vulnerabilities
Vulnerabilities for packages: flux, external-secrets-operator, rancher-agent, teleport, grafana, dex, minio, kyverno, spqr, rclone, gitea, cert-manager-cmctl, bento, rancher, trufflehog, k6, zot, juicefs, seaweedfs, flux-source-controller, yunikorn-k8shim, xeol, frp, telegraf, terraform,...
GHSA-J88V-2CHJ-QFWX vulnerabilities
Vulnerabilities for packages: gitness, gotrue, opentelemetry-collector-contrib-fips, harbor-fips, steampipe, keda-fips, step-ca, ory-kratos, temporal, gotrue-fips, k3s, gitlab-kas, grafana-alloy-fips, ldap2pg, openfga, seaweedfs, vault-fips, seaweedfs-rocksdb-fips, openbao,...
GHSA-FV83-X2XW-2J55 vulnerabilities
Vulnerabilities for packages: oras, flux, ingress-nginx-controller, external-secrets-operator, grafana-operator, grafana-rollout-operator, victoriametrics-cluster, gh, karpenter, aws-privateca-issuer, flux-image-automation-controller, omnibump, local-path-provisioner,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: kargo, kubescape-operator, descheduler, filebrowser, nerdctl, karpenter, kine, amazon-cloudwatch-agent-operator, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, terraform-provider-pagerduty, spqr, volume-modifier-for-k8s, cue,...
CVE-2026-34986 vulnerabilities
Vulnerabilities for packages: dkron-fips, keda-fips, temporal, external-secrets-operator, gotrue-fips, gitlab-kas, crossplane, dagger, cosign-fips, livekit-server-fips, seaweedfs-rocksdb-fips, slsa-verifier, grpc-health-probe, commercial-chainloop-backend, ko-fips, packer-fips,...
CVE-2026-30915
SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...
SUSE CVE-2026-30914
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...
SUSE CVE-2026-30915
SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...
GO-2026-4699 SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo...
GO-2026-4697 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo...
CVE-2026-30915
SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...
CVE-2026-30914
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...