CVE-2026-30915: 
NixOS vulnerability analysis and mitigation

CVE-2026-30915 is a path traversal vulnerability in SFTPGo caused by improper sanitization of placeholders in group home directories and key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders such as %username%, the value substituted for the placeholder is not strictly validated against relative path components (e.g., ../). This allows an attacker with the ability to create users to craft a username that causes the resolved path to escape the intended subdirectory and point to a parent directory. Affected versions are SFTPGo >= 2.3.0 and <= 2.7.0; version 2.7.1 contains the fix. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, SFTPGo Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) and CWE-20 (Improper Input Validation). SFTPGo supports dynamic group configuration using placeholders like %username% to construct home directory paths or storage key prefixes; however, the username value is not sanitized to strip or reject relative path components such as ../. An attacker with low-privilege access (e.g., an administrator who can create users) can supply a crafted username containing path traversal sequences, causing the resulting home directory or key prefix to resolve outside the intended directory tree. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, SFTPGo Advisory).

Successful exploitation allows an attacker to manipulate the resolved home directory or storage key prefix of a newly created user, potentially causing it to point to a parent or sibling directory outside the intended scope. This primarily affects integrity (unauthorized path resolution and potential unauthorized file access or writes in unintended directories) with a limited confidentiality impact (low-level read access to files in traversed directories). Availability is not impacted, and there is no evidence of lateral movement potential beyond the file system scope of the SFTPGo service account (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-30915. The EPSS score is approximately 0.062% (0.000620), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-level privileges — specifically, the ability to create users in SFTPGo — limiting the attack surface to authenticated administrators or users with user-management permissions (GitHub Advisory, Feedly).

1. Identify a vulnerable instance: Confirm the target SFTPGo deployment is running a version between 2.3.0 and 2.7.0 and has groups configured with dynamic home directories or key prefixes using the %username% placeholder.
2. Obtain user-creation privileges: Gain access to an account or API token with permissions to create users in SFTPGo (e.g., an admin account or a delegated admin role).
3. Craft a malicious username: Create a username containing path traversal sequences, such as ../../targetdir, which will be substituted into the group's home directory template (e.g., /data/users/%username% becomes /data/users/../../targetdir).
4. Create the user: Submit the crafted username via the SFTPGo admin UI, REST API, or other provisioning mechanism to register the new user.
5. Access the traversed path: Authenticate as the newly created user via SFTP, FTP, or WebDAV; the resolved home directory will point to the unintended parent or sibling directory, potentially exposing or allowing writes to files outside the intended user directory (SFTPGo Advisory).

• Logs: SFTPGo audit logs showing user creation events with usernames containing .., %2e%2e, or other path traversal sequences; login events for users whose home directory resolves outside the expected base path.
• File System: Unexpected file access or modification events in directories outside the designated SFTPGo user home base directory, attributable to the SFTPGo service account.
• Configuration: Presence of user accounts in SFTPGo with usernames containing relative path components (e.g., ../, ..\) when reviewed via the admin interface or API (GET /api/v2/users).

The vulnerability is fixed in SFTPGo version v2.7.1. All users running versions 2.3.0 through 2.7.0 should upgrade immediately. No configuration-based workaround is documented; the recommended remediation is to apply the patch. As an interim measure, administrators should audit existing user accounts for usernames containing path traversal sequences and restrict user-creation permissions to trusted administrators only (SFTPGo Advisory, GitHub Advisory).

The vulnerability was disclosed by the SFTPGo maintainer (drakkan) via a GitHub Security Advisory on March 13, 2026, and was rated as Moderate severity. An openSUSE security announcement was also published referencing this CVE. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (SFTPGo Advisory, openSUSE).