Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/drakkan/sftpgo/v2

12 known vulnerabilities (2 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 2 high, 9 medium, 1 low
Registry
pkg.go.dev

Advisories 12

  • CVE-2026-103028Medium 4.3

    SFTPGo source-side file-pattern filter bypass during copy operations

    Affected: from 2.5.0, fixed in 2.7.6.

  • CVE-2026-77375Medium 6.5

    SFTPGo: Denial of service via malformed SSH channel request

    Affected: fixed in 2.7.5.

  • CVE-2026-49244Medium 5.9

    SFTPGo: Path confinement bypass in public browsable share partial ZIP download

    Affected: from 2.2.0, fixed in 2.7.3.

  • SFTPGo: Stored XSS via inline parameter on public shares and user file download

    Affected: from 2.2.0, fixed in 2.7.3.

  • CVE-2026-30915Medium 5.3

    SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

    Affected: from 2.3.0, fixed in 2.7.1.

  • CVE-2026-30914Medium 5.3

    SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

    Affected: fixed in 2.7.1.

  • Insufficient sanitization of user provided rsync command in SFTPGo

    Affected: from 0.9.5, fixed in 2.6.5; fixed in 2.6.5.

  • CVE-2024-52801Medium 5.3

    Brute force takeover of OpenID Connect session cookies in sftpgo

    Affected: from 2.3.0, fixed in 2.6.4.

  • CVE-2024-52309Medium 5.1

    SFTPGo allows administrators to restrict command execution from the EventManager

    Affected: from 2.4.0, fixed in 2.6.3.

  • CVE-2024-37897Medium 5.4

    Insufficient access control for password reset in sftpgo

    Affected: from 2.2.0, fixed in 2.6.1.

  • CVE-2022-39220Medium 6.1

    XSS Vulnerabilities in WebClient

    Affected: fixed in 2.3.5.

  • Recovery codes abuse in SFTPGo

    Affected: from 2.2.0, fixed in 2.3.4.