What is CVE-2026-10031?

CVE-2026-10031 is a medium-severity vulnerability in Drakkan Sftpgo, classified under Incorrect Authorization. CVSS score: 4.2/10. Published 2026-07-30.

How severe is CVE-2026-10031?

Medium severity. CVSS v3 base score is 4.2 out of 10.

Auth bypass in Drakkan Sftpgo

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where downl…

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Drakkan Sftpgo — versions 0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (release-notes, patch)
disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-10031?: CVE-2026-10031 is a medium-severity vulnerability in Drakkan Sftpgo, classified under Incorrect Authorization. CVSS score: 4.2/10. Published 2026-07-30.
How severe is CVE-2026-10031?: Medium severity. CVSS v3 base score is 4.2 out of 10.