drakkan vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20243
3. 20251
4. 20267

Newest CVEs

• CVE-2026-103028

  SFTPGo source-side file-pattern filter bypass during copy operations

  drakkan · sftpgo

  Medium4.3
• CVE-2026-77375

  SFTPGo: Denial of service via malformed SSH channel request

  drakkan · sftpgo

  Medium6.5
• CVE-2026-49244

  SFTPGo: Path confinement bypass in public browsable share partial ZIP download

  drakkan · sftpgo

  Medium5.9
• CVE-2026-49245

  SFTPGo: Stored XSS via inline parameter on public shares and user file download

  drakkan · sftpgo

  Low3.7
• CVE-2026-10031

  SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation

  drakkan · SFTPGo

  Medium5.3
• CVE-2026-30915

  SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

  drakkan · sftpgo

  Medium5.3
• CVE-2026-30914

  SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

  drakkan · sftpgo

  Medium5.3
• CVE-2025-24366

  Insufficient sanitization of user provided rsync command in SFTPGo

  drakkan · sftpgo

  High7.5
• CVE-2024-52801

  Brute force takeover of OpenID Connect session cookies in sftpgo

  drakkan · sftpgo

  Medium5.3
• CVE-2024-52309

  SFTPGo allows administrators to restrict command execution from the EventManager

  drakkan · sftpgo

  Medium5.1