Executive brief
SFTPGo, a multi-protocol file transfer server, is affected by a security flaw that allows users to bypass folder-level restrictions. An authenticated user with permission to create symbolic links can access or modify files in restricted directories by linking them to a folder where they have higher permissions. While this does not allow access to other users' data or the underlying operating system, it defeats internal access controls designed to limit a user's activity within their own storage area.
Technical details
A permission bypass vulnerability exists in SFTPGo versions prior to 2.7.4 due to incorrect authorization checks when handling symbolic links on local filesystem and SFTP backends. The software authorized file operations based on the permissions of the directory containing the symbolic link rather than the permissions of the dereferenced target directory. An authenticated attacker with 'create_symlinks' and read/write permissions in at least one directory can create a link to a file in a restricted directory (where download/upload/overwrite are denied) to read or modify its contents. The vulnerability is limited to the user's own storage root and does not facilitate a container escape or cross-account access. Version 2.7.4 fixes this by disabling symbolic link creation by default and requiring 'create_symlinks' permissions on both the link's source and target directories.
Affected products
- drakkan SFTPGo < 2.7.4
Timeline
- 2026-06-27: patched: Version 2.7.4 released
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: NVD publication date