5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30914

CVE-2026-30914: SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30914

CVE-2026-30914:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/drakkan/sftpgo/v2	go	<= 2.7.0	2.7.1
github.com/drakkan/sftpgo	go	<= 1.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in SFTPGo versions prior to 2.7.1. It stems from a discrepancy in how file paths are normalized between the protocol handlers (SFTP, FTP) and the underlying virtual filesystem (VFS).

Authenticated attackers could craft malicious paths using a mix of forward slashes (/), backslashes (\\), and directory traversal sequences (..). The protocol handlers would pass these un-sanitized paths to the VFS layer. The VFS routing logic, which determines which filesystem backend to use (e.g., local, S3, GCS), could interpret the path differently than the permission checking logic, leading to an authorization bypass. This allowed an attacker to access files or directories outside of their designated home directory or virtual folder, effectively bypassing folder-level permissions.

The patch, identified in commit 2f092d128917e2c059520a2ce3e22c3b5ea7ffd6, addresses this by moving the path sanitization to the "edge" – the very beginning of the protocol handler functions. The fix involves consistently converting all backslashes to forward slashes and then cleaning the path (e.g., resolving .. components) using a new util.CleanPath function before any further processing, such as permission checks or VFS routing, takes place.

The vulnerable functions are the methods within the FTP (internal/ftpd/handler.go) and SFTP (internal/sftpd/handler.go) connection handlers that accept file paths as input from the user. These functions were modified to include calls to util.CleanPath or the new updateRequestPaths helper function as the first step in their execution.

Vulnerable functions

Connection.Mkdir

internal/ftpd/handler.go

This function handles the 'MKD' (Make Directory) command in the FTP server. Before the patch, it took a raw 'name' argument from the client and used it without sanitization. This allowed an attacker to use path traversal sequences (e.g., '..\\..') to create directories outside their allowed directory. The patch adds a call to 'util.CleanPath' to sanitize the input path at the beginning of the function.

Connection.Remove

internal/ftpd/handler.go

This function handles file deletion for FTP connections. It was vulnerable because it did not sanitize the input 'name' before passing it to 'GetFsAndResolvedPath'. An attacker could craft a path with traversal sequences to delete files outside of their restricted directory. The fix introduces 'util.CleanPath(name)' to prevent this.

Connection.Rename

internal/ftpd/handler.go

This function handles file and directory renaming for FTP connections. It was vulnerable as it used 'oldname' and 'newname' directly from the client without sanitization, allowing an attacker to move files into or out of restricted locations using path traversal. The patch adds calls to 'util.CleanPath' for both paths.

Connection.Stat

internal/ftpd/handler.go

This function retrieves file status (metadata) for FTP connections. The lack of input sanitization on the 'name' parameter allowed an attacker to stat files outside their home directory by crafting a malicious path, potentially leaking information about the server's filesystem structure. The fix is to clean the path with 'util.CleanPath'.

Connection.Fileread

internal/sftpd/handler.go

This function handles file read requests for SFTP connections. It was vulnerable because it used the 'request.Filepath' directly. An attacker could craft a path with traversal sequences (e.g., using backslashes) to read arbitrary files on the system. The patch adds a call to the new 'updateRequestPaths' helper function to sanitize the path before any processing.

Connection.Filewrite

internal/sftpd/handler.go

This function (via its helper 'handleFilewrite') handles file write requests for SFTP connections. It was vulnerable to path traversal because it used the 'request.Filepath' without prior sanitization, allowing an attacker to write or overwrite files in arbitrary locations on the server. The patch mitigates this by calling 'updateRequestPaths' to clean the path.

Connection.Filelist

internal/sftpd/handler.go

This function handles directory listing requests for SFTP. It was vulnerable because it processed 'request.Filepath' without sanitization, allowing an attacker to list the contents of directories outside their allowed scope using crafted paths. The fix involves calling 'updateRequestPaths' to normalize the path first.

Connection.RealPath

internal/sftpd/handler.go

This function resolves a given path to its absolute path. The vulnerability lay in the order of operations: the permission check was performed on the raw path 'p' *before* it was cleaned. An attacker could provide a path like '/s3/../../local/file' which would pass the permission check for '/s3' but then be resolved to a file in the '/local' mount, bypassing restrictions. The patch corrects this by cleaning the path *before* the permission check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.