Executive brief
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
Affected products
- Go github.com/drakkan/sftpgo/v2
- Go github.com/drakkan/sftpgo
Junglewise Threat Intelligence
CVE-2026-30915: GO-2026-4697 - SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
CVE-2026-30915 · Severity: medium · CVSS 4 · Published 2026-03-16
Technologies: github.com/drakkan/sftpgo/v2 (Go), github.com/drakkan/sftpgo (Go). Vendors: Go.
Related threats
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file do
- SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint f
- GO-2026-4699 - SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
- GO-2025-3458 - SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo
- GO-2024-3300 - sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo