SFTPGo has insufficient sanitization of user provided rsync command

高 7.5CVE-2025-24366 · GHSA-vj7w-3m8c-6vpx · GO-2025-3458 · 07/02/2025 公開 · 17/06/2026 更新

要点

CVE-2025-24366 は github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.73%（全脆弱性の 54.3% より高い）。
対処：2.6.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/drakkan/sftpgo Go	`≤ 1.2.2全バージョン`	修正版なし
github.com/drakkan/sftpgo/v2 Go	`≥ 0.9.5, < 2.6.5< 2.6.5`	`2.6.5`

概要

Impact

SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being rsync: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends.

Due to missing sanitization of the client provided rsync command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process.

Patches

This issue was fixed in version v2.6.5 by checking the client provided arguments.

https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1

NVD の説明

SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability.