Executive brief
Withdrawn: SFTPGo's JWT implmentation lacks certain security measures
Affected products
- Go github.com/drakkan/sftpgo/v2
Junglewise Threat Intelligence
CVE-2024-40430: Withdrawn: SFTPGo's JWT implmentation lacks certain security measures
CVE-2024-40430 · Severity: low · CVSS 3.1 · Published 2024-07-22
Technologies: github.com/drakkan/sftpgo/v2 (Go). Vendors: Go.
Related threats
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file do
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint f
- GO-2026-4697 - SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
- GO-2026-4699 - SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
- GO-2025-3458 - SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo