CVE-2026-10031

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4

Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite permissions are denied. By leveraging the create symlinks permission along with read and write access in a permitted directory, an attacker can read or modify files in restricted areas because the system authorizes operations based on the link's directory permissions instead of the permissions of the dereferenced target directory.

Recommendations Update to version 2.7.4 or later. Restrict the use of the create symlinks permission to minimize the risk of exploitation.