CVE-2026-10031: SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the createsymlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SFTPGoto a version that resolves this vulnerability.Fixed in 2.7.4 - Compensating control
As a mitigation until upgraded, prevent or restrict authenticated users from creating symbolic links in directories where they have read/write access combined with denied permissions on symlink targets (e.g., restrict symlink creation capability and limit filesystem write permissions for non-admin users).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10031?
CVE-2026-10031 has a medium severity rating of 4.2.
How do I fix CVE-2026-10031?
To fix CVE-2026-10031, upgrade SFTPGo to version 2.7.4 or later.
What vulnerability does CVE-2026-10031 exploit?
CVE-2026-10031 exploits a permission bypass issue via symbolic link creation in SFTPGo.
Who is affected by CVE-2026-10031?
Authenticated users of SFTPGo prior to version 2.7.4 are affected by CVE-2026-10031.
What can attackers do with CVE-2026-10031?
Attackers can circumvent per-directory access controls to access restricted files by creating symbolic links.