Authorization Bypass Vulnerability in SFTPGo by Drakkan

CVE-2026-30914

What is CVE-2026-30914?

SFTPGo, an open-source file transfer solution, has a vulnerability that allows authenticated attackers to bypass folder-level permissions. This security issue arises from a path normalization discrepancy between protocol handlers and the internal Virtual Filesystem routing in versions prior to 2.7.1. Attackers can exploit this flaw by crafting specific file paths, enabling them to gain unauthorized access and possibly escape configured Virtual Folder boundaries. Users are advised to upgrade to version 2.7.1 or later to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References