Path Traversal in Drakkan Sftpgo

CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypas…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.000 (7.8th percentile) — read the EPSS interpretation.