EUVD-2026-51360
GHSA-3964-29ff-vwff
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector as SFTP is remote; AC:L because once permissions are granted the exploit is mechanically trivial; PR:L for required authentication and specific permission grant; no scope change or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.
AnalysisAI
SFTPGo versions prior to 2.7.4 expose a permission bypass allowing authenticated users holding the create_symlinks permission to circumvent per-directory access controls by creating symbolic links that bridge permitted and restricted directories. Authorization is evaluated against the symlink's parent directory rather than the dereferenced target, so read and write operations succeed against paths the user should not be able to reach. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 2.3 reflects the combined effect of high attack complexity and low privilege requirements.
Technical ContextAI
SFTPGo is an open-source, full-featured SFTP/FTP/WebDAV file transfer server written in Go, typically deployed as a multi-tenant file access service with per-directory permission rules. The vulnerability is rooted in CWE-863 (Incorrect Authorization): when the server resolves a client-initiated file operation that traverses a symbolic link, it authorizes the request against the permissions of the directory containing the link rather than the permissions of the directory the link resolves to. This symlink-following authorization gap means the server's per-directory ACL model is effectively short-circuited for any operation that passes through a user-created symlink. The fix introduced in v2.7.4 adds a new symlink_mode configuration knob - disabled by default - that requires the create_symlinks permission to be present on both the link's parent directory and the link's target directory before the operation is authorized, restoring consistent ACL enforcement across the resolved path.
RemediationAI
Upgrade SFTPGo to version 2.7.4 or later, which introduces the symlink_mode backend setting (disabled by default) and enforces create_symlinks permission checks on both the link source directory and the link target directory. Release notes and binaries are available at https://github.com/drakkan/sftpgo/releases/tag/v2.7.4. For deployments that cannot upgrade immediately, revoke the create_symlinks permission from all user accounts as a compensating control; this fully eliminates the attack path but also prevents legitimate symlink creation. Alternatively, audit per-directory ACL configurations to ensure no user is granted create_symlinks access alongside cross-directory privilege differentials until the patch is applied. Restricting SFTP access at the network layer (firewall rules, VPN enforcement) reduces exposure but does not mitigate the authorization flaw for already-authenticated users.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today