PT-2026-25354 · Sftpgo · Sftpgo

Mcantrell · Publicado 2026-03-13 · Atualizado 2026-03-25 · CVE-2026-30914

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.1

Description SFTPGo is an open-source, event-driven file transfer solution. A path normalization discrepancy exists between the protocol handlers and the internal Virtual Filesystem routing in versions prior to 2.7.1. This discrepancy can lead to an authorization bypass. An authenticated attacker can create specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.

Recommendations Update to SFTPGo version 2.7.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-30914

GHSA-X8QH-7475-C5MP

GO-2026-4699

SUSE-SU-2026:1042-1

Produtos afetados

Sftpgo

Referências · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30914.json · Exploit
• https://github.com/drakkan/sftpgo · Nota
• https://github.com/drakkan/sftpgo/commit/2f092d128917e2c059520a2ce3e22c3b5ea7ffd6 · Nota
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-x8qh-7475-c5mp · Aviso do Fabricante
• https://suse.com/support/update/announcement/2026/suse-su-20261042-1 · Nota
• https://suse.com/security/cve/CVE-2026-29049 · Nota
• https://suse.com/security/cve/CVE-2026-31866 · Nota
• https://suse.com/security/cve/CVE-2026-29196 · Nota
• https://suse.com/security/cve/CVE-2026-28342 · Nota
• https://suse.com/security/cve/CVE-2026-29781 · Nota
• https://suse.com/security/cve/CVE-2026-26196 · Nota
• https://suse.com/security/cve/CVE-2026-28407 · Nota
• https://suse.com/security/cve/CVE-2026-28789 · Nota
• https://suse.com/security/cve/CVE-2026-25679 · Nota
• https://suse.com/security/cve/CVE-2026-32110 · Nota