GitHub Advisoryadvisory · Go

GHSA-vj7w-3m8c-6vpx SFTPGo has insufficient sanitization of user provided rsync command

HIGH Published 2025-02-07 Modified 2025-02-10 Official page ↗
Aliases
CVE-2025-24366
Ecosystem
Go
Packages
github.com/drakkan/sftpgo/v2, github.com/drakkan/sftpgo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2025-02-07

Affected packages

• Go github.com/drakkan/sftpgo/v2: >= 0.9.5, < 2.6.5 → fixed in 2.6.5 • Go github.com/drakkan/sftpgo: <= 1.2.2 (no fix yet)

Description

Impact SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. Patches This issue was fixed in version v2.6.5 by checking the client provided arguments. https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1

Related

Alias · CVE (1)

  • CVE-2025-24366 SFTPGo is an open source, event-driven file transfer solution. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References