PT-2026-25355 · Sftpgo · Sftpgo

Published 2026-03-13 · Updated 2026-03-25 · CVE-2026-30915

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.1

Description SFTPGo is an open source, event-driven file transfer solution. Versions of SFTPGo before 2.7.1 contain an input validation issue when handling dynamic group paths, such as home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not adequately sanitized against relative path components. This allows a specially crafted username to cause the resulting path to resolve to a parent directory instead of the intended sub-directory. The vulnerable component is the handling of dynamic group paths. The vulnerable parameter is the username used in the placeholder.

Recommendations Update to version 2.7.1 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2026-30915

GHSA-M83Q-5WR4-4GFP

GO-2026-4697

SUSE-SU-2026:1042-1

Affected Products

Sftpgo

References · 135

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30915.json · Exploit
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m83q-5wr4-4gfp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30915 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30915 · Security Note
• https://github.com/drakkan/sftpgo · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261042-1 · Note
• https://suse.com/security/cve/CVE-2026-29049 · Note
• https://suse.com/security/cve/CVE-2026-31866 · Note
• https://suse.com/security/cve/CVE-2026-29196 · Note
• https://suse.com/security/cve/CVE-2026-28342 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note
• https://suse.com/security/cve/CVE-2026-26196 · Note