CyberRota Analysis
AI-GeneratedSFTPGo versions prior to 2.7.4 are vulnerable to a permission bypass issue that allows authenticated users to create symbolic links in permitted directories, enabling them to access files in restricted directories where they should not have permissions. This can lead to unauthorized reading or modification of sensitive files, posing a risk to data integrity and confidentiality. Organizations using SFTPGo should prioritize patching to mitigate potential exploitation of this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.