EUVD-2026-12072
GHSA-x8qh-7475-c5mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SFTPGo server
-
ExploitCraft malicious file path with normalization bypass
-
ExecutionTraverse Virtual Folder boundaries
-
ImpactAccess unauthorized files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Valid SFTPGo user credentials required. SFTPGo version prior to 2.7.1 with Virtual Folder or folder-level permission configuration enabled. Attacker must have existing authenticated SFTP/FTPS/WebDAV session access. |
| Impact | The CVSS v4.0 vector (5.3 base score) indicates network accessibility (AV:N), low attack complexity (AC:L), no targeted attack prerequisites (AT:N), and low privileges required (PR:N with user interaction UI:P). However, this CVE requires prior authentication (implicit in the description 'authenticated attacker'), which significantly reduces real-world risk compared to an unauthenticated bypass. The low impact ratings (VC:L, VI:L, VA:L) suggest confidentiality, integrity, and availability impacts are limited in scope. Without disclosed EPSS data, KEV listing, or public POC availability, this appears to be a real but not actively exploited vulnerability. The remediation availability (patch in 2.7.1) and moderate CVSS suggest this should be prioritized for patching in production SFTPGo deployments, but it is not an immediate critical priority. Organizations running SFTPGo with untrusted local users or in multi-tenant environments face higher risk due to the authorization bypass nature. |
| Exploit ScenarioDerived | An authenticated SFTPGo user with access to a limited Virtual Folder containing only non-sensitive files could craft specially-normalized path requests (e.g., using path traversal sequences, case variations, or redundant separators that bypass the protocol handler's normalization but pass through to the VFS router unresolved) to access restricted directories outside their intended scope. For example, a user with access to /uploads/ could request a path like /uploads/../../../etc/passwd or /uploads/./../../sensitive_data/ to escape the folder boundary and read files in other user directories or system paths. The attack requires valid SFTP/FTP/WebDAV credentials and a Multi-folder/SFTP sharing configuration, but no special tools—just standard file transfer client commands with malformed paths. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
SFTPGo versions prior to 2.7.1 contain a path normalization vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) that allows authenticated attackers to bypass folder-level permissions and escape Virtual Folder boundaries through crafted file paths. An attacker with valid credentials can exploit this authorization bypass to access files and directories beyond their intended scope. The vulnerability has been patched in version 2.7.1 with strict edge-level path normalization, and while no public POC or KEV status has been disclosed, the CVSS 5.3 (network-accessible, low complexity) and requirement for prior authentication suggest this is a real but moderate-priority issue.
RemediationAI
Upgrade SFTPGo to version 2.7.1 or later immediately to apply the strict edge-level path normalization fix. The patch ensures all protocol inputs are fully sanitized and resolved to canonical POSIX paths before routing or permission evaluation. Until patching is possible, mitigate by restricting SFTP/FTP access to trusted networks via firewall rules, disabling virtual folder usage if not required, and implementing strict folder-level permissions with regular audits of user access. Verify the patch is applied by checking the SFTPGo version output and reviewing the changelog at the vendor's official repository. No configuration-only workarounds exist for this logic flaw, making patching the only reliable remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SFTPGo is a file transfer server implementation supporting SFTP, HTTP/WebDAV, and FTP protocols. The vulnerability stems from a discrepancy between how protocol handlers (SFTP, HTTP, FTP) normalize file paths and how the internal Virtual Filesystem (VFS) routing layer processes those paths. CWE-22 (Path Traversal / Directory Escape) indicates insufficient canonicalization of user-supplied paths before permission checks occur. The affected component is the path normalization logic that should convert all protocol-layer inputs to canonical POSIX paths before permission evaluation against folder-level access controls and Virtual Folder boundaries. This is a classic authorization logic flaw where path normalization happens too late or inconsistently across protocol entry points, allowing attackers to supply alternative path representations (e.g., with redundant separators, relative segments, or encoding variations) that bypass ACL checks in the VFS routing engine.
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.
Patches
This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.
Executive ViewAI
Organizations using SFTPGo face notable risk from CVE-2026-30914, a path traversal vulnerability rated CVSS 8.1. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in SFTPGo Authorization and Input Validation
View all 5Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Exploit-DB