Threats affecting pkg:github/drakkan/sftpgo

CVE-2026-103028 is an authorization vulnerability in drakkan sftpgo versions 2.5.0 up to but not including 2.7.6. It allows an authenticated user with copy permissions to bypass file pattern filters that are intended to restrict access to certain files. By copying files denied by filters to permitted names or locations, the user can read contents of files that should be inaccessible according to the configured filters. Other access controls such as home directory restrictions, virtual folder layouts, and per-directory permissions remain enforced. There is no administrative privilege escalation or cross-account access.

### Summary A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel. ### Impact Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.