Authorization Bypass Vulnerability in SFTPGo by Drakkan
CVE-2026-30914

5.3MEDIUM

Key Information:

Vendor

Drakkan

Status
Sftpgo
Vendor
CVE Published:
13 March 2026

What is CVE-2026-30914?

SFTPGo, an open-source file transfer solution, has a vulnerability that allows authenticated attackers to bypass folder-level permissions. This security issue arises from a path normalization discrepancy between protocol handlers and the internal Virtual Filesystem routing in versions prior to 2.7.1. Attackers can exploit this flaw by crafting specific file paths, enabling them to gain unauthorized access and possibly escape configured Virtual Folder boundaries. Users are advised to upgrade to version 2.7.1 or later to mitigate this issue.

Affected Version(s)

sftpgo < 2.7.1

References

https://github.com/drakkan/sftpgo/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.