EUVD-2026-12073
GHSA-m83q-5wr4-4gfp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | The CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N indicates a network-accessible vulnerability requiring low privilege (authenticated user) with low attack complexity, resulting in low confidentiality and integrity impact with no availability impact. This score reflects a contained threat: the attacker must be authenticated and the impact is limited to unauthorized access to sibling or parent directories rather than system-wide compromise. The absence of an EPSS score or KEV (Known Exploited Vulnerability) designation suggests this is not currently being exploited in the wild. Cross-referencing CVSS signals with real-world context: the low complexity and network accessibility are offset by the authentication requirement and limited impact scope. This represents a moderate-priority vulnerability—not a critical flaw, but sufficiently practical that patching should occur within normal security update cycles (2-4 weeks) rather than emergency response timeframes. Organizations with multi-tenant SFTP deployments where user creation is delegated are at higher risk. |
| Exploit ScenarioDerived | An authenticated user in a multi-tenant SFTPGo deployment observes that their home directory is dynamically set to /sftp/home/%username%. The attacker requests a new user account with the username crafted as ../../../etc or similar relative path traversal sequence. Upon account creation, the SFTP server resolves the dynamic path to /sftp/home/../../../etc, effectively placing the attacker's home directory in /etc or another system directory outside the intended sandbox. The attacker can then read, modify, or exfiltrate sensitive configuration files or data belonging to other tenants or the host system, depending on file permissions. While this requires user account creation privileges (not anonymous access), a compromised administrative account or insider threat scenario makes this practical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
SFTPGo versions before v2.7.1 suffer from improper input validation in dynamic group path handling, where placeholder substitution (e.g., %username%) fails to sanitize relative path traversal sequences. An authenticated attacker with user creation privileges can craft a malicious username containing path traversal components (such as ../) to escape the intended directory structure and access parent directories, achieving unauthorized directory traversal with low to moderate impact on confidentiality and integrity. The vulnerability requires authenticated access and is not listed as actively exploited in known exploit databases, though the fix availability and moderate CVSS score suggest it warrants prompt patching.
RemediationAI
Immediately upgrade SFTPGo to version 2.7.1 or later, which contains the necessary input validation fixes for dynamic group path handling. Patch releases should be deployed to all instances, and administrators should verify that the patched version correctly rejects or sanitizes usernames containing path traversal sequences (../, ..\ etc.). Until patching is completed, implement compensating controls by restricting user creation privileges to trusted administrators only and avoiding dynamic group configurations with %username% placeholders if possible—instead use static home directories or implement manual user provisioning workflows. Organizations should also audit existing user accounts to identify any with suspicious usernames containing relative path components and remediate or delete such accounts. Consult the SFTPGo security advisories and release notes at https://github.com/drakkan/sftpgo/releases/tag/v2.7.1 for detailed patch notes and migration guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SFTPGo is an SFTP server implementation that supports dynamic path configuration for home directories and key prefixes using template variables. The root cause is classified under CWE-20 (Improper Input Validation), wherein user-supplied data (specifically usernames) are interpolated into path expressions without proper canonicalization or validation against relative path components. When a group is configured with a dynamic home directory such as /home/%username%, the system directly substitutes the username placeholder without stripping or rejecting sequences like ../ that would cause path traversal. This is a classic input validation flaw in path construction where user-controlled input is embedded into file system paths without sanitization, affecting the SFTP service's ability to enforce directory containment.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes.
When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory.
Patches
This issue is fixed in version v2.7.1
Executive ViewAI
Organizations using SFTPGo versions before v2.7.1 contain an input validation should be aware of moderate risk from CVE-2026-30915, a input validation vulnerability rated CVSS 4.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB