CVE-2026-30914: 
NixOS vulnerability analysis and mitigation

CVE-2026-30914 is a path traversal and permission bypass vulnerability in SFTPGo caused by a path normalization discrepancy between protocol handlers and the internal Virtual Filesystem routing. Authenticated attackers can craft specific file paths — using backslashes, double slashes, mixed separators, or relative traversal sequences — to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. It affects all SFTPGo versions up to and including 2.7.0 (both the v1 module <= 1.2.2 and the v2 module <= 2.7.0). The vulnerability was published on March 13, 2026, with a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, SFTPGo Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): path sanitization was not performed at the protocol handler layer (SFTP/FTP handlers) before paths were passed to the Virtual Filesystem (VFS) routing and permission evaluation logic. Because the protocol handlers and the VFS router applied different or no normalization, an attacker could supply paths containing backslashes (\), double slashes (//), mixed separators, or .. traversal sequences that the router would resolve to a different filesystem location than intended. The fix (commit 2f092d1) moves backslash conversion and path.Clean-style normalization to the SFTP/FTP edge handlers so all inputs are resolved to canonical POSIX paths before any routing or permission checks occur (SFTPGo Advisory, Fix Commit). Example bypass patterns documented in the patch tests include \s3\..\local\secret.txt (cross-mount traversal) and //s3//dir/data.csv (double-slash normalization bypass) (Fix Commit).

A successfully exploited vulnerability allows an authenticated attacker to read or write files outside their authorized Virtual Folder boundaries, with high confidentiality and integrity impact per the CVSS v3.1 scoring. Attackers could access sensitive files stored in other users' Virtual Folders or in the underlying host filesystem paths exposed through misconfigured mounts. Availability is not directly impacted, but unauthorized write access could allow data tampering or planting of malicious files within the SFTPGo-managed storage (GitHub Advisory, SFTPGo Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires valid (low-privilege) credentials to the SFTPGo instance, reducing the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.07% (0.000700), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys scanner has detection coverage (detection ID 761789) (Feedly).

1. Authenticate: Obtain valid (low-privilege) SFTP or FTP credentials to the target SFTPGo instance running a version prior to 2.7.1.
2. Enumerate Virtual Folder structure: Use standard SFTP directory listing commands to identify configured Virtual Folder mount points (e.g., /s3, /local).
3. Craft a traversal path: Construct a file path that exploits the normalization discrepancy. Examples include:
   • Cross-mount bypass: \s3\..\local\secret.txt (backslash + traversal to reach a different Virtual Folder)
   • Double-slash bypass: //s3//sensitive/data.csv
   • Mixed separator traversal: /local/../../etc/passwd
   • Relative path without leading slash: local/../s3/file.txt
4. Issue file operation: Send an SFTP GET, PUT, STAT, or RENAME command using the crafted path. Because the path is not normalized before VFS routing, the server resolves it to a location outside the attacker's authorized folder.
5. Access or modify unauthorized files: Read sensitive files from other Virtual Folders or the host filesystem, or write/overwrite files in unauthorized locations (SFTPGo Advisory, Fix Commit).

• Network: SFTP or FTP sessions from authenticated users containing file paths with backslashes (\), double slashes (//), mixed separators, or .. sequences in path arguments; unusual cross-folder file access patterns in a single session.
• Logs: SFTPGo access logs showing file operations (GET, PUT, STAT, RENAME) targeting paths outside a user's configured Virtual Folder boundaries; log entries with raw backslash characters or URL-encoded path separators in the requested path field.
• File System: Unexpected files appearing in Virtual Folders or host directories that should not be accessible to the authenticated user; modification timestamps on files in restricted directories coinciding with SFTP session activity.
• Process/Application: SFTPGo audit log entries where the resolved physical path does not correspond to the user's assigned home directory or Virtual Folder mapped path.

Upgrade SFTPGo to version 2.7.1 or later, which introduces strict edge-level path normalization in the SFTP and FTP protocol handlers before any VFS routing or permission evaluation (SFTPGo Advisory, Fix Commit). No official configuration-based workaround is provided; patching is the only reliable remediation. As interim measures, restrict SFTP/FTP access to trusted IP ranges at the network level, audit Virtual Folder configurations for overly broad mappings, and review access logs for anomalous cross-folder path patterns.

The vulnerability was reported by researcher mcantrell and addressed promptly by the SFTPGo maintainer (Nicola Murino) in version 2.7.1 released the same day as disclosure (SFTPGo Advisory). An openSUSE security announcement was issued for downstream package consumers (openSUSE). A NixOS/nixpkgs issue was also filed to track the update (NixOS Issue). No significant broader media coverage or notable social media discussion has been identified.