SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy

高 8.1CVE-2026-30914 · GHSA-x8qh-7475-c5mp · GO-2026-4699 · 13/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-30914 は github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2, sftpgo (sftpgo project) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.55%（全脆弱性の 46.2% より高い）。
対処：2.7.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/drakkan/sftpgo Go	`≤ 1.2.2全バージョン`	修正版なし
github.com/drakkan/sftpgo/v2 Go	`< 2.7.1`	`2.7.1`
sftpgo sftpgo_project	`< 2.7.1`	`2.7.1`

概要

Impact

In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.

Patches

This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.

NVD の説明

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.