drakkan sftpgo vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Latest drakkan sftpgo vulnerabilities

CVE-2026-77375 — SFTPGo: Denial of service via malformed SSH channel request (CVSS 6.5)
CVE-2026-103028 — SFTPGo source-side file-pattern filter bypass during copy operations (CVSS 4.3)
CVE-2026-49245 — SFTPGo: Stored XSS via inline parameter on public shares and user file download (CVSS 3.7)
CVE-2026-49244 — SFTPGo: Path confinement bypass in public browsable share partial ZIP download (CVSS 5.9)
CVE-2026-10031 — SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation (CVSS 5.4)
CVE-2026-30915 — SFTPGo improperly sanitizes placeholders in group home directories/key prefixes (CVSS 4.3)
CVE-2026-30914 — SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy (CVSS 8.1)
CVE-2025-24366 — Insufficient sanitization of user provided rsync command in SFTPGo (CVSS 7.5)
CVE-2024-52801 — Brute force takeover of OpenID Connect session cookies in sftpgo (CVSS 5.3)
CVE-2024-52309 — SFTPGo allows administrators to restrict command execution from the EventManager (CVSS 5.1)
CVE-2024-37897 — Insufficient access control for password reset in sftpgo (CVSS 5.4)
CVE-2023-48795 — Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin (CVSS 5.9)
CVE-2022-39220 — XSS Vulnerabilities in WebClient (CVSS 6.1)
CVE-2022-36071 — Recovery codes abuse in SFTPGo (CVSS 8.1)