Sftpgo
Monthly
SFTPGo versions 2.5.0 through 2.7.5 allow an authenticated user with copy permission to bypass file pattern filters because these filters are evaluated only on the copy destination, enabling read access to denied files and reproduction of restricted content via recursive directory copies. The hide policy is also bypassed, as files that appear missing to stat and directory listings can still be copied. Fixed in 2.7.6; no public exploit identified at time of analysis. CVSS 4.3 reflects limited confidentiality impact since home-directory boundaries, virtual-folder layout, per-directory permissions, and access to other accounts remain enforced.
Malformed SSH subsystem requests crash the entire SFTPGo server process in versions prior to 2.7.5, disconnecting every concurrently connected user until an administrator manually restarts the service. Any authenticated SSH account (CVSS PR:L, network-reachable, no user interaction) can trigger it by opening a session channel and sending a short or otherwise invalid subsystem payload, so exposure is greatest on multi-tenant instances that provision accounts to untrusted or low-trust users, while single-tenant or trusted-operator deployments carry materially lower risk. Only availability is affected (C:N/I:N/A:H, 6.5), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fixed in 2.7.5.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
SFTPGo is an SFTP server written in Go. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SFTPGo versions 2.5.0 through 2.7.5 allow an authenticated user with copy permission to bypass file pattern filters because these filters are evaluated only on the copy destination, enabling read access to denied files and reproduction of restricted content via recursive directory copies. The hide policy is also bypassed, as files that appear missing to stat and directory listings can still be copied. Fixed in 2.7.6; no public exploit identified at time of analysis. CVSS 4.3 reflects limited confidentiality impact since home-directory boundaries, virtual-folder layout, per-directory permissions, and access to other accounts remain enforced.
Malformed SSH subsystem requests crash the entire SFTPGo server process in versions prior to 2.7.5, disconnecting every concurrently connected user until an administrator manually restarts the service. Any authenticated SSH account (CVSS PR:L, network-reachable, no user interaction) can trigger it by opening a session channel and sending a short or otherwise invalid subsystem payload, so exposure is greatest on multi-tenant instances that provision accounts to untrusted or low-trust users, while single-tenant or trusted-operator deployments carry materially lower risk. Only availability is affected (C:N/I:N/A:H, 6.5), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fixed in 2.7.5.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
SFTPGo is an SFTP server written in Go. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.