SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

Vulnerability

Overview

SFTPGo, an open-source event-driven file transfer solution, contains an input validation flaw in versions prior to v2.7.1. The issue arises when a group is configured with a dynamic home directory or key prefix that includes placeholders such as %username%. The value substituted for the placeholder is not properly sanitized against relative path components (e.g., ../), enabling path traversal [1][4].

Exploitation

An attacker who can create or control a username (for example, through user registration or administrative actions) can craft a username containing relative path sequences. When the server-side. When SFTPGo resolves the dynamic path, the unsanitized placeholder value can cause the resulting path to point to a parent directory instead of the intended sub-directory. This attack requires the ability to set a username that includes path traversal sequences, and the group must be configured to use dynamic placeholders [1][4]. 4].

Impact

Successful exploitation allows an attacker to access files or directories outside the intended scope, potentially reading, writing, or listing files in parent directories. This could lead to unauthorized access to sensitive data or further compromise of the SFTPGo server [1][4].

Mitigation

The vulnerability is fixed in SFTPGo version v2.7.1. Users should upgrade to this version or later. No workarounds are mentioned in the advisories [1][4]. The issue is tracked as GHSA-m83q-5wr4-4gfp and GO-2026-4697 [3][3][4].