SFTPGo vulnerabilities
3 known vulnerabilities in SFTPGo from Drakkan. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
sftpgo: Improper Limitation of a Pathname to a Restricted Directory
SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated a
- 7.5 High severity
sftpgo: Improper Neutralization of Special Elements used in an OS Command
SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default c
- 8.1 High severity
sftpgo: Use of Password Hash With Insufficient Computational Effort
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices