sftpgo
- Software type
- File transfer
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/23/2026, sftpgo recorded 5 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of sftpgo and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-103028SFTPGo source-side file-pattern filter bypass during copy operationsCVE-2026-77375SFTPGo: Denial of service via malformed SSH channel requestCVE-2026-49244SFTPGo: Path confinement bypass in public browsable share partial ZIP downloadCVE-2026-49245SFTPGo: Stored XSS via inline parameter on public shares and user file downloadCVE-2026-10031SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-103028SFTPGo source-side file-pattern filter bypass during copy operations | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-77375SFTPGo: Denial of service via malformed SSH channel request | Exploitation statusNot exploited | FixYes | Published10/13/2026 | SeverityMedium |
|---|
CVE-2026-49244SFTPGo: Path confinement bypass in public browsable share partial ZIP download | Exploitation statusNot exploited | FixYes | Published08/20/2026 | SeverityMedium |
|---|
CVE-2026-49245SFTPGo: Stored XSS via inline parameter on public shares and user file download | Exploitation statusNot exploited | FixYes | Published08/20/2026 | SeverityLow |
|---|
CVE-2026-10031SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation | Exploitation statusNot exploited | FixYes | Published07/30/2026 | SeverityMedium |
|---|
CVE-2026-30915SFTPGo improperly sanitizes placeholders in group home directories/key prefixes | Exploitation statusNot exploited | FixYes | Published03/13/2026 | SeverityMedium |
|---|
CVE-2026-30914SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy | Exploitation statusNot exploited | FixYes | Published03/13/2026 | SeverityMedium |
|---|
CVE-2025-24366Insufficient sanitization of user provided rsync command in SFTPGo | Exploitation statusNot exploited | FixYes | Published02/07/2025 | SeverityHigh |
|---|
CVE-2024-52801Brute force takeover of OpenID Connect session cookies in sftpgo | Exploitation statusNot exploited | FixYes | Published11/29/2024 | SeverityMedium |
|---|
CVE-2024-52309SFTPGo allows administrators to restrict command execution from the EventManager | Exploitation statusNot exploited | FixNo | Published11/21/2024 | SeverityMedium |
|---|
13 Results | Page 1 of 2