LOW3.7Go
GHSA-3vcg-pv95-pq54· CVE-2026-49245, GO-2026-5900SFTPGo has stored XSS via inline parameter on public shares and user file download
Modified: 7/7/2026
package
Go/github.com/drakkan/sftpgo/v2
pkg:go/github.com/drakkan/sftpgo/v2
MEDIUMGo
GHSA-49cc-xrjf-9qf7· CVE-2024-52309, GO-2024-3283SFTPGo allows administrators to restrict command execution from the EventManager
Modified: 12/2/2024
HIGH8.3Go
GHSA-54qx-8p8w-xhg8· CVE-2022-36071, GO-2022-0964SFTPGo vulnerable to recovery codes abuse
Modified: 8/21/2024
MEDIUMGo
GHSA-6943-qr24-82vx· CVE-2024-52801, GO-2024-3300sftpgo vulnerable to brute force takeover of OpenID Connect session cookies
Modified: 12/2/2024
MEDIUM5.9Go
GHSA-h64p-8h4r-6gfh· CVE-2026-49244, GO-2026-5902SFTPGo has path confinement bypass in public browsable share partial ZIP download
Modified: 7/7/2026
MEDIUM6.5Go
GHSA-hw5f-6wvv-xcrh· CVE-2024-37897, GO-2024-2940SFTPGo has insufficient access control for password reset
Modified: 9/10/2026
MEDIUMGo
GHSA-m83q-5wr4-4gfp· CVE-2026-30915, GO-2026-4697SFTPGo improperly sanitizes placeholders in group home directories/key prefixes
Modified: 3/24/2026
HIGH7.5Go
GHSA-vj7w-3m8c-6vpx· CVE-2025-24366, GO-2025-3458SFTPGo has insufficient sanitization of user provided rsync command
Modified: 2/10/2025
MEDIUMGo
GHSA-x8qh-7475-c5mp· CVE-2026-30914, GO-2026-4699SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy
Modified: 3/24/2026
—Go
GO-2022-0964· CVE-2022-36071, GHSA-54qx-8p8w-xhg8SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo
Modified: 3/3/2026
—Go
GO-2022-1015· CVE-2022-39220, GHSA-cf7g-cm7q-rq7fSFTPGo WebClient vulnerable to Cross-site Scripting in github.com/drakkan/sftpgo
Modified: 3/3/2026
—Go
GO-2024-2940· CVE-2024-37897, GHSA-hw5f-6wvv-xcrhSFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo
Modified: 3/3/2026
—Go
GO-2024-3283· CVE-2024-52309, GHSA-49cc-xrjf-9qf7SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo
Modified: 3/3/2026
—Go
GO-2024-3300· CVE-2024-52801, GHSA-6943-qr24-82vxsftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo
Modified: 3/3/2026
—Go
GO-2025-3458· CVE-2025-24366, GHSA-vj7w-3m8c-6vpxSFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo
Modified: 3/3/2026
—Go
GO-2026-4697· CVE-2026-30915, GHSA-m83q-5wr4-4gfpSFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
Modified: 3/23/2026
—Go
GO-2026-4699· CVE-2026-30914, GHSA-x8qh-7475-c5mpSFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
Modified: 3/23/2026
—Go
GO-2026-5900· CVE-2026-49245, GHSA-3vcg-pv95-pq54SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo
Modified: 7/7/2026
—Go
GO-2026-5902· CVE-2026-49244, GHSA-h64p-8h4r-6gfhSFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo
Modified: 7/7/2026