Input Validation Issue in SFTPGo File Transfer Solution by Drakkan
CVE-2026-30915

5.3MEDIUM

Key Information:

Vendor

Drakkan

Status
Sftpgo
Vendor
CVE Published:
13 March 2026

What is CVE-2026-30915?

SFTPGo, an open-source, event-driven file transfer solution, suffers from an input validation flaw within the handling of dynamic group paths. Specifically, when a dynamic home directory or key prefix is configured using placeholders (e.g., %username%), the replacement value is inadequately sanitized. This lax validation allows for specially crafted usernames to potentially resolve to unintended parent directories, compromising the intended directory structure. This vulnerability has been addressed in version v2.7.1, ensuring safer handling of directory paths.

Affected Version(s)

sftpgo >= 2.3.0, < 2.7.1

References

https://github.com/drakkan/sftpgo/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.