Improper Input Validation Vulnerability in SFTPGo by Drakkan

CVE-2025-24366

What is CVE-2025-24366?

SFTPGo, an open-source file transfer solution, has revealed a vulnerability concerning its execution of SSH commands. The lack of sanitization on the user-provided rsync command allows an authenticated remote user to exploit certain options. This could enable unauthorized read or write access to files with the permissions corresponding to the SFTPGo server process. Users should update to version v2.6.5, which addresses this issue by implementing stringent checks on client-supplied arguments to the rsync command. No workarounds exist.

References