Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/drakkan/sftpgo

12 known vulnerabilities (2 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 2 high, 9 medium, 1 low
Registry
pkg.go.dev

Advisories 12

  • CVE-2026-103028Medium 4.3

    SFTPGo source-side file-pattern filter bypass during copy operations

    Affected: all versions.

  • CVE-2026-77375Medium 6.5

    SFTPGo: Denial of service via malformed SSH channel request

    Affected: all versions.

  • CVE-2026-49244Medium 5.9

    SFTPGo: Path confinement bypass in public browsable share partial ZIP download

    Affected: all versions.

  • SFTPGo: Stored XSS via inline parameter on public shares and user file download

    Affected: all versions.

  • CVE-2026-30915Medium 5.3

    SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

    Affected: all versions.

  • CVE-2026-30914Medium 5.3

    SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

    Affected: through 1.2.2; all versions.

  • Insufficient sanitization of user provided rsync command in SFTPGo

    Affected: through 1.2.2; all versions.

  • CVE-2024-52801Medium 5.3

    Brute force takeover of OpenID Connect session cookies in sftpgo

    Affected: all versions.

  • CVE-2024-52309Medium 5.1

    SFTPGo allows administrators to restrict command execution from the EventManager

    Affected: all versions.

  • CVE-2024-37897Medium 5.4

    Insufficient access control for password reset in sftpgo

    Affected: all versions.

  • CVE-2022-39220Medium 6.1

    XSS Vulnerabilities in WebClient

    Affected: all versions; fixed in 2.3.5.

  • Recovery codes abuse in SFTPGo

    Affected: all versions.