Executive brief
SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo
Affected products
- Go github.com/drakkan/sftpgo/v2
- Go sftpgo
- Go github.com/drakkan/sftpgo
Junglewise Threat Intelligence
CVE-2024-52309: GO-2024-3283 - SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo
CVE-2024-52309 · Severity: medium · CVSS 4 · Published 2024-11-21
Technologies: github.com/drakkan/sftpgo/v2 (Go), github.com/drakkan/sftpgo (Go). Vendors: Go.
Related threats
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file do
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint f
- GO-2026-4697 - SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
- GO-2026-4699 - SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
- GO-2025-3458 - SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo