5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30915

CVE-2026-30915: SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30915

CVE-2026-30915:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/drakkan/sftpgo/v2	go	>= 2.3.0, <= 2.7.0	2.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of dynamic group paths in SFTPGo, specifically when creating a user's home directory from a group template with placeholders. The analysis of the patches between versions 2.7.0 and 2.7.1 revealed two key weaknesses that, when combined, lead to a path traversal vulnerability.

First, the dataprovider.validateBaseParams function failed to adequately sanitize usernames. This allowed the creation of users with malicious usernames containing relative path components like ../.

Second, the dataprovider.User.mergeWithPrimaryGroup function, which constructs the user's home directory by replacing placeholders such as %username% in a group's home directory template, did not clean the resulting path.

An attacker could exploit this by creating a user with a crafted username (e.g., ../attacker). When this user is assigned to a group with a dynamic home directory (e.g., /home/%username%), the mergeWithPrimaryGroup function would generate the path /home/../attacker, which resolves to /attacker, a directory outside of the intended parent. This allows the attacker to set their home directory to an arbitrary location on the filesystem that the SFTPGo process has write access to.

The patch addresses these issues by:

Introducing strict username validation in dataprovider.validateBaseParams via the new util.IsNameValid function.
Adding a call to filepath.Clean() in dataprovider.User.mergeWithPrimaryGroup to sanitize the final home directory path, removing any traversal sequences.

Vulnerable functions

dataprovider.User.mergeWithPrimaryGroup

internal/dataprovider/user.go

This function is responsible for setting a user's home directory based on a group's template. It uses a string replacer to substitute placeholders like `%username%`. Before the patch, the result of this replacement was not sanitized. A malicious username containing path traversal sequences (e.g., `../baduser`) would result in a home directory path that resolves outside the intended base directory. The patch fixes this by wrapping the path construction in `filepath.Clean()` to resolve and clean the path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.