github.com/drakkan/sftpgo/v2
Go10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/drakkan/sftpgo/v2page 1 of 1
- CVE-2022-36071HIGHCVSS 8.3EG 8.3✓ Fixed in 2.3.42022-09-02
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configu…
- CVE-2022-39220MEDIUMCVSS 6.1EG 6.1✓ Fixed in 2.3.52022-09-20
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. …
- CVE-2024-37897MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2.6.12024-06-20
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In…
- CVE-2024-52309MEDIUMCVSS 5.1EG 5.1✓ Fixed in 2.6.32024-11-21
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in r…
- CVE-2024-52801MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2.6.42024-11-29
sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby g…
- CVE-2025-24366HIGHCVSS 7.5EG 7.5✓ Fixed in 2.6.52025-02-07
SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disa…
- CVE-2026-30914HIGHCVSS 8.1EG 8.1✓ Fixed in 2.7.12026-03-13
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypas…
- CVE-2026-30915MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2.7.12026-03-13
SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configure…
- CVE-2026-49244MEDIUMCVSS 5.9EG 5.9✓ Fixed in 2.7.32026-07-02
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rath…
- CVE-2026-49245LOWCVSS 3.7EG 3.7✓ Fixed in 2.7.32026-07-02
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing …
Check whether github.com/drakkan/sftpgo/v2 is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/drakkan/sftpgo/v2 CVEs against the assets you own.
Start Free Scan →