-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper argument validation in the rsync command handler. The commit diff shows that prior to the patch, the getSystemCommand() function in ssh_cmd.go processed rsync arguments without proper validation. The fix introduced the canAcceptRsyncArgs() validation check within this function. The vulnerable versions lacked this critical sanitization step, allowing attackers to manipulate rsync options. The function's direct handling of user-controlled input (args parameter) and its role in constructing system commands make it the primary vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/drakkan/sftpgo/v2 | go | >= 0.9.5, <= 2.6.4 | 2.6.5 |
| github.com/drakkan/sftpgo | go | <= 1.2.2 |