CVE-2026-30914: SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy

March 13, 2026 (updated March 24, 2026)

In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder.

References

github.com/advisories/GHSA-x8qh-7475-c5mp
github.com/drakkan/sftpgo
github.com/drakkan/sftpgo/commit/2f092d128917e2c059520a2ce3e22c3b5ea7ffd6
github.com/drakkan/sftpgo/security/advisories/GHSA-x8qh-7475-c5mp
nvd.nist.gov/vuln/detail/CVE-2026-30914
pkg.go.dev/vuln/GO-2026-4699

Code Behaviors & Features

Detect and mitigate CVE-2026-30914 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →