GitHub Advisoryadvisory · Go

GHSA-x8qh-7475-c5mp SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy

MEDIUM Published 2026-03-13 Modified 2026-03-24 Official page ↗
Aliases
CVE-2026-30914
Ecosystem
Go
Packages
github.com/drakkan/sftpgo/v2, github.com/drakkan/sftpgo
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2026-03-13

Affected packages

• Go github.com/drakkan/sftpgo/v2: < 2.7.1 → fixed in 2.7.1 • Go github.com/drakkan/sftpgo: <= 1.2.2 (no fix yet)

Description

Impact In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. Patches This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.

Related

Alias · CVE (1)

  • CVE-2026-30914 SFTPGo is an open source, event-driven file transfer solution. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References