Drakkan vulnerabilities
We track 3 vulnerabilities in Drakkan products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 13, 2026.
Latest Drakkan vulnerabilities
- 8.1 High severity
sftpgo: Improper Limitation of a Pathname to a Restricted Directory
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated a
- 7.5 High severity
sftpgo: Improper Neutralization of Special Elements used in an OS Command
SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default c
- 8.1 High severity
sftpgo: Use of Password Hash With Insufficient Computational Effort
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices