CVE-2026-30914 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

Medium 5.3 Published 13 Mar 2026 Updated 13 Mar 2026

An authenticated attacker can bypass folder permissions and escape virtual folder boundaries in SFTPGo via path normalization discrepancies.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-30914?

CVE-2026-30914 is a medium-severity path traversal vulnerability in drakkan sftpgo, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.

Weakness: CWE-22

Which versions are affected by CVE-2026-30914?

6 open source packages ship an affected version, including github.com/drakkan/sftpgo and github.com/drakkan/sftpgo/v2. It affects 1 product.

Package	Affected	Fixed in
`github.com/drakkan/sftpgo` Go	All versions	None
`github.com/drakkan/sftpgo` Go	All versions to `1.2.2`	None
`github.com/drakkan/sftpgo` Go	All versions to `1.2.2`	None
`github.com/drakkan/sftpgo/v2` Go	All versions	`2.7.1`
`github.com/drakkan/sftpgo/v2` Go	All versions	`2.7.1`
`github.com/drakkan/sftpgo/v2` Go	All versions	`2.7.1`

Products include Sftpgo Project Sftpgo.

How do I fix CVE-2026-30914?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-30914 being exploited?

There is no known exploitation of CVE-2026-30914 in the wild and no public exploit code.

Sources

Also known as GHSA-x8qh-7475-c5mp, GO-2026-4699.