Executive brief
SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo
Affected products
- Go github.com/drakkan/sftpgo/v2
- Go github.com/drakkan/sftpgo
Junglewise Threat Intelligence
CVE-2024-37897: GO-2024-2940 - SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo
CVE-2024-37897 · Severity: low · CVSS 3.1 · Published 2024-06-28
Technologies: github.com/drakkan/sftpgo/v2 (Go), github.com/drakkan/sftpgo (Go). Vendors: Go.
Related threats
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file do
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint f
- GO-2026-4697 - SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
- GO-2026-4699 - SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
- GO-2025-3458 - SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo