CVE-2026-10031

Received Received - Intake

SFTPGo Permission Bypass via Symbolic Links

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-10031

EUVD

EUVD-2026-51360

Affected Vendors & Products

Vendor	Product	Version / Range
sftpgo	sftpgo	to 2.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

SFTPGo before version 2.7.4 has a permission bypass flaw where authenticated users can create symbolic links in allowed directories that point to files in restricted directories. This lets them bypass per-directory access controls by exploiting the create_symlinks permission combined with read/write access in permitted areas to read or modify files in unauthorized locations.

Detection Guidance

To detect this vulnerability, check for unauthorized symbolic links in permitted directories pointing to restricted directories. Use commands like 'find /path/to/sftpgo -type l -ls' to list symbolic links and verify their targets. Also review SFTPGo logs for suspicious symlink creation events.

Impact Analysis

If you use SFTPGo, attackers with valid credentials could access sensitive files outside their permitted directories by creating symbolic links. This could lead to unauthorized data exposure, modification, or deletion of restricted files, even if the attacker lacks direct permissions to those directories.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA by allowing unauthorized access to restricted files through symbolic link exploitation. If sensitive data is stored in directories with improper access controls, attackers could read or modify such data, leading to breaches of confidentiality and integrity requirements mandated by these regulations.

Mitigation Strategies

Upgrade SFTPGo to version 2.7.4 or later to address the permission bypass vulnerability. Review and restrict the create_symlinks permission in SFTPGo configurations to prevent unauthorized symbolic link creation.

Hi! I’m here to help you understand CVE-2026-10031. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70