ZeroDay Findings
Sign inSign up

Findings

CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution.

Published Mar 13, 2026 · updated Jun 17, 2026 · sftpgo project sftpgo

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 13, 2026 · NIST NVD

    Detected

    SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulne

  2. Jun 17, 2026 · NIST NVD

    Updated

    SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulne

Affected

  • cpe sftpgo project/sftpgoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-30914

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-30914

    SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft sp

    nvd.nist.gov

References