PT-2026-25354 · Sftpgo · Sftpgo

Mcantrell · Published 2026-03-13 · Updated 2026-03-25 · CVE-2026-30914

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.1

Description SFTPGo is an open-source, event-driven file transfer solution. A path normalization discrepancy exists between the protocol handlers and the internal Virtual Filesystem routing in versions prior to 2.7.1. This discrepancy can lead to an authorization bypass. An authenticated attacker can create specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.

Recommendations Update to SFTPGo version 2.7.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30914

GHSA-X8QH-7475-C5MP

GO-2026-4699

SUSE-SU-2026:1042-1

Affected Products

Sftpgo

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30914.json · Exploit
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-x8qh-7475-c5mp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x8qh-7475-c5mp · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30914 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30914 · Security Note
• https://github.com/drakkan/sftpgo · Note
• https://github.com/drakkan/sftpgo/commit/2f092d128917e2c059520a2ce3e22c3b5ea7ffd6 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261042-1 · Note
• https://suse.com/security/cve/CVE-2026-29049 · Note
• https://suse.com/security/cve/CVE-2026-31866 · Note
• https://suse.com/security/cve/CVE-2026-29196 · Note
• https://suse.com/security/cve/CVE-2026-28342 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note