CVE-2025-24366: Insufficient sanitization of user provided rsync command in SFTPGo
First published: Fri Feb 07 2025(Updated: )
### Impact SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. ### Patches This issue was fixed in version v2.6.5 by checking the client provided arguments. https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/drakkan/sftpgo | <=1.2.2 | |
| go/github.com/drakkan/sftpgo/v2 | >=0.9.5<=2.6.4 | 2.6.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-24366?
The severity of CVE-2025-24366 has not been explicitly stated, but it pertains to security concerns associated with command execution in SFTPGo.
How do I fix CVE-2025-24366?
To fix CVE-2025-24366, update SFTPGo to version 2.6.5 or later.
Which versions of SFTPGo are affected by CVE-2025-24366?
CVE-2025-24366 affects SFTPGo versions from 0.9.5 up to and including 2.6.4.
What commands are associated with CVE-2025-24366?
CVE-2025-24366 relates to command execution via SSH, specifically optional commands like 'rsync'.
Is 'rsync' enabled by default in SFTPGo for CVE-2025-24366?
No, the 'rsync' command is disabled by default in the SFTPGo configuration.
- agent/weakness
- agent/first-publish-date
- agent/title
- agent/type
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- agent/source
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vj7w-3m8c-6vpx
- alias/CVE-2025-24366
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-cve
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory
- package-manager/go