SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy

CAO 8.1CVE-2026-30914 · GHSA-x8qh-7475-c5mp · GO-2026-4699 · Công bố 13/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-30914 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2, sftpgo (sftpgo project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.55%, cao hơn 46.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.7.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/drakkan/sftpgo Go	`≤ 1.2.2mọi phiên bản`	Chưa có bản vá
github.com/drakkan/sftpgo/v2 Go	`< 2.7.1`	`2.7.1`
sftpgo sftpgo_project	`< 2.7.1`	`2.7.1`

Mô tả

Impact

In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.

Patches

This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.

Mô tả của NVD

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.