EUVD-2026-12072
GHSA-x8qh-7475-c5mp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Impact
In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.
Patches
This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.
AnalysisAI
SFTPGo versions prior to 2.7.1 contain a path normalization vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) that allows authenticated attackers to bypass folder-level permissions and escape Virtual Folder boundaries through crafted file paths. An attacker with valid credentials can exploit this authorization bypass to access files and directories beyond their intended scope. The vulnerability has been patched in version 2.7.1 with strict edge-level path normalization, and while no public POC or KEV status has been disclosed, the CVSS 5.3 (network-accessible, low complexity) and requirement for prior authentication suggest this is a real but moderate-priority issue.
Technical ContextAI
SFTPGo is a file transfer server implementation supporting SFTP, HTTP/WebDAV, and FTP protocols. The vulnerability stems from a discrepancy between how protocol handlers (SFTP, HTTP, FTP) normalize file paths and how the internal Virtual Filesystem (VFS) routing layer processes those paths. CWE-22 (Path Traversal / Directory Escape) indicates insufficient canonicalization of user-supplied paths before permission checks occur. The affected component is the path normalization logic that should convert all protocol-layer inputs to canonical POSIX paths before permission evaluation against folder-level access controls and Virtual Folder boundaries. This is a classic authorization logic flaw where path normalization happens too late or inconsistently across protocol entry points, allowing attackers to supply alternative path representations (e.g., with redundant separators, relative segments, or encoding variations) that bypass ACL checks in the VFS routing engine.
RemediationAI
Upgrade SFTPGo to version 2.7.1 or later immediately to apply the strict edge-level path normalization fix. The patch ensures all protocol inputs are fully sanitized and resolved to canonical POSIX paths before routing or permission evaluation. Until patching is possible, mitigate by restricting SFTP/FTP access to trusted networks via firewall rules, disabling virtual folder usage if not required, and implementing strict folder-level permissions with regular audits of user access. Verify the patch is applied by checking the SFTPGo version output and reviewing the changelog at the vendor's official repository. No configuration-only workarounds exist for this logic flaw, making patching the only reliable remediation.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today