CVE-2026-10031: Incorrect Authorization in drakkan SFTPGo
SFTPGo versions prior to 2.7.4 have a permission bypass vulnerability that allows authenticated users with the create_symlinks permission to circumvent directory access controls. By creating symbolic links in directories where they have read and write access, attackers can access or modify files in directories where such permissions are normally denied. This occurs because authorization checks are performed against the symbolic link's directory permissions rather than the target file's directory permissions.
AI Analysis
Technical Summary
CVE-2026-10031 describes a permission bypass vulnerability in drakkan SFTPGo before version 2.7.4. Authenticated users granted the create_symlinks permission can create symbolic links in allowed directories that point to files in restricted directories. Since the system authorizes operations based on the link's directory permissions instead of the dereferenced target's permissions, attackers can read or modify files in directories where they should not have access. This flaw enables circumvention of per-directory access controls via symbolic link manipulation.
Potential Impact
The vulnerability allows authenticated users with limited permissions to bypass directory-level access controls, potentially reading or modifying files in restricted directories. However, the overall impact is limited by the requirement for authentication and the need for the create_symlinks permission. The CVSS score of 2.3 and low severity rating reflect the limited scope and complexity of exploitation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the create_symlinks permission to trusted users only to reduce risk. Monitor vendor communications for updates regarding patches or official mitigations.
CVE-2026-10031: Incorrect Authorization in drakkan SFTPGo
Description
SFTPGo versions prior to 2.7.4 have a permission bypass vulnerability that allows authenticated users with the create_symlinks permission to circumvent directory access controls. By creating symbolic links in directories where they have read and write access, attackers can access or modify files in directories where such permissions are normally denied. This occurs because authorization checks are performed against the symbolic link's directory permissions rather than the target file's directory permissions.
CVSS v4.0
Score 2.3low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-10031 describes a permission bypass vulnerability in drakkan SFTPGo before version 2.7.4. Authenticated users granted the create_symlinks permission can create symbolic links in allowed directories that point to files in restricted directories. Since the system authorizes operations based on the link's directory permissions instead of the dereferenced target's permissions, attackers can read or modify files in directories where they should not have access. This flaw enables circumvention of per-directory access controls via symbolic link manipulation.
Potential Impact
The vulnerability allows authenticated users with limited permissions to bypass directory-level access controls, potentially reading or modifying files in restricted directories. However, the overall impact is limited by the requirement for authentication and the need for the create_symlinks permission. The CVSS score of 2.3 and low severity rating reflect the limited scope and complexity of exploitation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the create_symlinks permission to trusted users only to reduce risk. Monitor vendor communications for updates regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-28T18:37:02.626Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6bdccd9c2644c7f8d9d027
Added to database: 07/30/2026, 23:22:53 UTC
Last enriched: 07/30/2026, 23:53:52 UTC
Last updated: 07/31/2026, 00:54:38 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.