CVE-2026-30914: falha de média gravidade em drakkan sftpgo
SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.6%
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
drakkan · sftpgoCVEs relacionadas — drakkan sftpgo
No mesmo produto, das mais perigosas para as menos.
CVE-2025-24366HIGHInsufficient sanitization of user provided rsync command in SFTPGoEPSS 0.7%CVE-2022-39220MEDIUMXSS Vulnerabilities in WebClientEPSS 0.6%CVE-2024-52309MEDIUMSFTPGo allows administrators to restrict command execution from the EventManagerEPSS 0.6%CVE-2022-36071HIGHRecovery codes abuse in SFTPGoEPSS 0.5%CVE-2026-49244MEDIUMSFTPGo: Path confinement bypass in public browsable share partial ZIP downloadEPSS 0.4%CVE-2024-52801MEDIUMBrute force takeover of OpenID Connect session cookies in sftpgoEPSS 0.4%