Nullx3D

**Name of the Vulnerable Software and Affected Versions** SFTPGo versions prior to 2.7.4 **Description** Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite permissions are denied. By leveraging the `create symlinks` permission along with read and write access in a permitted directory, an attacker can read or modify files in restricted areas because the system authorizes operations based on the link's directory permissions instead of the permissions of the dereferenced target directory. **Recommendations** Update to version 2.7.4 or later. Restrict the use of the `create symlinks` permission to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.4.3 **Description** A time-of-check to time-of-use (TOCTOU) race condition exists in the daemon file handling. This occurs when an rsync daemon is configured with the `chroot` setting set to false. A local attacker with write access to a module path can replace a parent directory component with a symbolic link between the time the receiver checks the path and the time it calls the `open()` function. This allows the attacker to redirect reads and writes outside the intended directories, enabling the disclosure of basis-files or the creation and overwriting of arbitrary files. If the daemon runs with elevated privileges, this can lead to privilege escalation. **Recommendations** Update to version 3.4.3 or later. Ensure the `chroot` setting is set to true to prevent this issue.