CVE-2026-10031 in SFTPGo
Summary
by MITRE • 07/31/2026
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability in SFTPGo prior to version 2.7.4 represents a critical permission bypass flaw that fundamentally undermines the security model of the file transfer service. This issue stems from improper handling of symbolic links within the access control system, where the software fails to properly validate the target directory permissions when processing symlink operations. The vulnerability affects the core authorization mechanism that governs user access to files and directories based on granular permissions assigned per directory.
The technical implementation flaw occurs in how SFTPGo processes file operations involving symbolic links created by authenticated users. When a user possesses create_symlinks permission combined with read and write access to a specific directory, they can exploit this combination to gain unauthorized access to files located in other directories where such access would normally be denied. The system incorrectly evaluates the security context during file operations by referencing only the permissions of the symbolic link's parent directory rather than the actual target file's directory permissions. This misinterpretation allows attackers to bypass intended access controls through clever manipulation of directory structures.
From an operational standpoint, this vulnerability enables attackers to escalate their privileges and access sensitive data that should remain restricted. The impact extends beyond simple data theft to include potential modification of critical system files, which could lead to further compromise of the underlying infrastructure. The attack vector requires minimal privileges initially since users only need create_symlinks permission along with basic read/write access to a single directory. However, this seemingly limited access can be leveraged to gain access to entire restricted file systems through the symbolic link mechanism.
The vulnerability aligns with CWE-284 Access Control Issues, specifically addressing improper access control when handling symbolic links and file system operations. It also relates to ATT&CK technique T1078 Valid Accounts, as attackers can exploit existing authenticated sessions to perform unauthorized actions without requiring additional credential compromise. Additionally, this flaw demonstrates characteristics of privilege escalation through path traversal mechanisms that commonly appear in file service implementations, making it a significant concern for organizations relying on SFTPGo for secure file transfers.
Organizations should immediately upgrade to version 2.7.4 or later to resolve this vulnerability, as the fix addresses the core permission evaluation logic by ensuring proper dereferencing of symbolic links against their target directory permissions rather than the link's parent directory permissions. Administrators should also review existing user permissions and access controls to minimize potential exploitation opportunities while awaiting the upgrade. The implementation of additional monitoring for symlink creation activities in sensitive directories can serve as a defensive measure to detect potential abuse attempts before they succeed in accessing restricted resources.