| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/drakkan/sftpgo | ≤ 1.2.2all versions | |
| github.com/drakkan/sftpgo/v2 | < 2.7.1 | 2.7.1 |
| sftpgo | < 2.7.1 | 2.7.1 |
In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.
This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free