CVE-2026-30915: falha de média gravidade em drakkan sftpgo
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
drakkan · sftpgoCVEs relacionadas — drakkan sftpgo
No mesmo produto, das mais perigosas para as menos.
CVE-2025-24366HIGHInsufficient sanitization of user provided rsync command in SFTPGoEPSS 0.7%CVE-2022-39220MEDIUMXSS Vulnerabilities in WebClientEPSS 0.6%CVE-2024-52309MEDIUMSFTPGo allows administrators to restrict command execution from the EventManagerEPSS 0.6%CVE-2026-30914MEDIUMSFTPGo has a Path Traversal and Permission Bypass via Path Normalization DiscrepancyEPSS 0.6%CVE-2022-36071HIGHRecovery codes abuse in SFTPGoEPSS 0.5%CVE-2026-49244MEDIUMSFTPGo: Path confinement bypass in public browsable share partial ZIP downloadEPSS 0.4%