GHSA-vj7w-3m8c-6vpx: OS Command Injection
First published: Fri Feb 07 2025(Updated: )
### Impact SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. ### Patches This issue was fixed in version v2.6.5 by checking the client provided arguments. https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/drakkan/sftpgo | <=1.2.2 | |
| go/github.com/drakkan/sftpgo/v2 | >=0.9.5<=2.6.4 | 2.6.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of GHSA-vj7w-3m8c-6vpx?
The severity of GHSA-vj7w-3m8c-6vpx is classified as moderate.
How do I fix GHSA-vj7w-3m8c-6vpx?
To fix GHSA-vj7w-3m8c-6vpx, you should update SFTPGo to version 2.6.5 or later.
Which versions are affected by GHSA-vj7w-3m8c-6vpx?
The versions affected by GHSA-vj7w-3m8c-6vpx range from 0.9.5 to 2.6.4 of SFTPGo.
What commands does GHSA-vj7w-3m8c-6vpx allow via SSH?
GHSA-vj7w-3m8c-6vpx specifically affects the execution of commands that may include the optional rsync command.
Is the rsync command enabled by default in GHSA-vj7w-3m8c-6vpx?
No, the rsync command is disabled by default in the configuration of SFTPGo.
- agent/weakness
- agent/severity
- agent/source
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vj7w-3m8c-6vpx
- alias/CVE-2025-24366
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- package-manager/go