CVE-2026-30915

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30915", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.884Z", "datePublished": "2026-03-13T19:04:36.856Z", "dateUpdated": "2026-03-13T19:41:17.258Z"}, "containers": {"cna": {"title": "SFTPGo improperly sanitizes placeholders in group home directories/key prefixes", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp"}], "affected": [{"vendor": "drakkan", "product": "sftpgo", "versions": [{"version": ">= 2.3.0, < 2.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:04:36.856Z"}, "descriptions": [{"lang": "en", "value": "SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1"}], "source": {"advisory": "GHSA-m83q-5wr4-4gfp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:41:05.203975Z", "id": "CVE-2026-30915", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:41:17.258Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30915", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:41:05.203975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:41:13.342Z"}}], "cna": {"title": "SFTPGo improperly sanitizes placeholders in group home directories/key prefixes", "source": {"advisory": "GHSA-m83q-5wr4-4gfp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "drakkan", "product": "sftpgo", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.7.1"}]}], "references": [{"url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp", "name": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:04:36.856Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30915", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:41:17.258Z", "dateReserved": "2026-03-07T16:40:05.884Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T19:04:36.856Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sftpgo", "vendor": "drakkan", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.7.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:*", "matchCriteriaId": "983B6DD7-63A7-4C3E-92A2-67AA7B363ECB", "versionEndExcluding": "2.7.1", "versionStartIncluding": "2.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1"}, {"lang": "es", "value": "SFTPGo es una soluci\u00f3n de transferencia de archivos de c\u00f3digo abierto y basada en eventos. Las versiones de SFTPGo anteriores a la v2.7.1 contienen un problema de validaci\u00f3n de entrada en el manejo de rutas de grupo din\u00e1micas, por ejemplo, directorios de inicio o prefijos de clave. Cuando un grupo se configura con un directorio de inicio o prefijo de clave din\u00e1mico utilizando marcadores de posici\u00f3n como %username%, el valor que reemplaza el marcador de posici\u00f3n no se sanea estrictamente contra componentes de ruta relativa. En consecuencia, si se crea un usuario con un nombre de usuario especialmente dise\u00f1ado, la ruta resultante puede resolverse en un directorio padre en lugar del subdirectorio previsto. Este problema se corrige en la versi\u00f3n v2.7.1."}], "id": "CVE-2026-30915", "lastModified": "2026-06-17T10:33:08.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30915", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:41:05.203975Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:35.410", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.0,2.7.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sftpgo", "source": "cna", "vendor": "drakkan"}, "product": "sftpgo", "vendor": "drakkan"}], "analysis": {"en": {"generated_at": "2026-03-18T21:52:44.604108+00:00", "value": {"mitigation_remediation": ["Upgrade SFTPGo to version 2.7.1 or later to eliminate the sanitization issue."], "summary": {"action": "Patch Now", "impact": "Directory Traversal \u2013 potential unauthorized file access"}, "threat_synthesis": {"affected_systems": "The vulnerable product is drakkan:sftpgo. All releases before v2.7.1 are affected. The issue is resolved in version v2.7.1 and later; no other vendors or products are listed as affected.", "description_and_impact": "SFTPGo versions prior to 2.7.1 contain an input validation flaw when processing dynamic group paths such as home directories or key prefixes. Placeholders like %username% are replaced without strict sanitization of relative path components, enabling a specially crafted username to resolve the resulting path to a parent directory instead of the intended sub\u2011directory. This flaw is a classic directory traversal (CWE\u201122) that could allow an attacker to read or write files outside the designated directory, potentially exposing confidential data.", "risk_and_exploitability": "The CVSS score is 5.3, indicating a moderate risk. EPSS is below 1%, suggesting a low probability of exploitation at present, and the vulnerability is not in the CISA KEV catalog. Exploitation requires the ability to create a user with a crafted username; the description does not specify the exact privilege level needed, but it is inferred that such an action must be performed through an interface that allows user creation. The likely attack vector is via the user management functionality of SFTPGo."}}}}, "created": "2026-03-16T09:24:29.527758+00:00", "updated": "2026-03-23T13:40:21.207801+00:00", "vendors": ["drakkan", "drakkan$PRODUCT$sftpgo"]}