CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

What is CVE-2026-30915?

CVE-2026-30915 is a medium-severity path traversal vulnerability in drakkan sftpgo, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1

Weakness: CWE-22

Which versions are affected by CVE-2026-30915?

4 open source packages ship an affected version, including github.com/drakkan/sftpgo/v2 and github.com/drakkan/sftpgo. It affects 1 product.

Products include Sftpgo Project Sftpgo.

How do I fix CVE-2026-30915?

Upgrade github.com/drakkan/sftpgo/v2 to 2.7.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-30915 being exploited?

There is no known exploitation of CVE-2026-30915 in the wild and no public exploit code.

Other vulnerabilities in drakkan sftpgo

• CVE-2022-36071 Recovery codes abuse in SFTPGo High 8.3
• CVE-2022-39220 XSS Vulnerabilities in WebClient Medium 6.1
• CVE-2026-30914 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m83q-5wr4-4gfp, GO-2026-4697.