GHSA-x8qh-7475-c5mp

Source

https://github.com/advisories/GHSA-x8qh-7475-c5mp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x8qh-7475-c5mp/GHSA-x8qh-7475-c5mp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x8qh-7475-c5mp

Aliases

Published

2026-03-13T18:55:52Z

Modified

2026-03-24T21:01:24.646638Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy

Details

Impact

In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.

Patches

This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ],
    "nvd_published_at": "2026-03-13T19:54:35Z",
    "github_reviewed_at": "2026-03-13T18:55:52Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/drakkan/sftpgo/v2

Package

Name: github.com/drakkan/sftpgo/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/drakkan/sftpgo/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.1

Database specific

last_known_affected_version_range

"<= 2.7.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x8qh-7475-c5mp/GHSA-x8qh-7475-c5mp.json"

Go / github.com/drakkan/sftpgo

Package

Name: github.com/drakkan/sftpgo; View open source insights on deps.dev
Purl: pkg:golang/github.com/drakkan/sftpgo

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.2.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x8qh-7475-c5mp/GHSA-x8qh-7475-c5mp.json"