CVE-2026-30914: SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy
Impact
In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.
Patches
This issue has been addressed in SFTPGo version 2.7.1. The fix introduces strict edge-level path normalization, ensuring that all protocol inputs are fully sanitized and resolved to canonical POSIX paths before any routing or permission evaluations occur.
Other sources
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30914?
CVE-2026-30914 has a high severity due to the potential for unauthorized access to restricted file paths.
How do I fix CVE-2026-30914?
To fix CVE-2026-30914, upgrade SFTPGo to version 2.7.1 or later.
What versions of SFTPGo are affected by CVE-2026-30914?
SFTPGo versions prior to 2.7.1, including 1.2.2 and all versions in the 2.7.0 range, are affected by CVE-2026-30914.
What type of vulnerability is CVE-2026-30914?
CVE-2026-30914 is a path traversal and permission bypass vulnerability.
Can CVE-2026-30914 be exploited by an unauthenticated attacker?
No, CVE-2026-30914 requires authentication to exploit, as it involves an authorized user's actions.