# CVE-2026-10031: drakkan SFTPGo permission bypass via symbolic link creation

Source: https://junglewise.ai/threats/cve-2026-10031-drakkan-sftpgo-permission-bypass-via-symbolic-link-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-10031 · Severity: medium · CVSS 4.2 · Published 2026-07-30

SFTPGo, a multi-protocol file transfer server, is affected by a security flaw that allows users to bypass folder-level restrictions. An authenticated user with permission to create symbolic links can access or modify files in restricted directories by linking them to a folder where they have higher permissions. While this does not allow access to other users' data or the underlying operating system, it defeats internal access controls designed to limit a user's activity within their own storage area.

## Quick answers

**Is CVE-2026-10031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10031 being exploited in the wild.

**How severe is CVE-2026-10031?** Medium severity, with a CVSS score of 4.2, published 30 July 2026.

**Which products and versions are affected?** drakkan SFTPGo < 2.7.4.

**Is there a fix for CVE-2026-10031?** A patch was published on 2026-06-27: Version 2.7.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10031 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-10031?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A permission bypass vulnerability exists in SFTPGo versions prior to 2.7.4 due to incorrect authorization checks when handling symbolic links on local filesystem and SFTP backends. The software authorized file operations based on the permissions of the directory containing the symbolic link rather than the permissions of the dereferenced target directory. An authenticated attacker with 'create_symlinks' and read/write permissions in at least one directory can create a link to a file in a restricted directory (where download/upload/overwrite are denied) to read or modify its contents. The vulnerability is limited to the user's own storage root and does not facilitate a container escape or cross-account access. Version 2.7.4 fixes this by disabling symbolic link creation by default and requiring 'create_symlinks' permissions on both the link's source and target directories.

## Affected products

- drakkan SFTPGo < 2.7.4

## Timeline

- 2026-06-27: patched: Version 2.7.4 released
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: NVD publication date

## References

- [https://github.com/drakkan/sftpgo](https://github.com/drakkan/sftpgo)
- [https://github.com/drakkan/sftpgo/releases/tag/v2.7.4](https://github.com/drakkan/sftpgo/releases/tag/v2.7.4)
- [https://github.com/drakkan/sftpgo/security/advisories/GHSA-fj9v-mxr3-w75w](https://github.com/drakkan/sftpgo/security/advisories/GHSA-fj9v-mxr3-w75w)
- [https://www.vulncheck.com/advisories/sftpgo-permission-bypass-via-symbolic-link-creation](https://www.vulncheck.com/advisories/sftpgo-permission-bypass-via-symbolic-link-creation)