Permission Bypass in SFTPGo Affects File Access Controls
CVE-2026-10031

2.3LOW

Key Information:

Vendor

Drakkan

Status
Sftpgo
Vendor
CVE Published:
30 July 2026

What is CVE-2026-10031?

SFTPGo, prior to version 2.7.4, is susceptible to a permission bypass vulnerability. This issue permits authenticated users to create symbolic links within allowable directories that redirect to files in restricted directories, circumventing access controls. The exploitation of this vulnerability relies on the create_symlinks permission combined with authorized read and write access, facilitating unauthorized access and modification of files that should remain restricted.

Affected Version(s)

SFTPGo 0

References

https://github.com/drakkan/sftpgo
product
https://github.com/drakkan/sftpgo/security/advisories/GHS...
vendor-advisory
https://github.com/drakkan/sftpgo/releases/tag/v2.7.4
patch

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nullx3D (Batuhan SANCAK)
.