SFTPGo versions prior to 2.7.4 permit authenticated users to create symbolic links in permitted directories that point to files in directories where download, upload, or overwrite permissions are denied. The service authorizes actions based on the link’s directory permissions rather than the target’s, enabling users to read or modify files outside their authorized scope.

The vulnerability affects the Drakkan SFTPGo server, specifically all releases before 2.7.4. Version 2.7.4 and later provide a fix and are not impacted.

The CVSS base score is 2.3, indicating low severity, and the EPSS score is < 1%, suggesting a very low exploitation probability. The vulnerability is not listed in KEV. Based on the description, the attack requires legitimate authentication and the ability to create symbolic links; thus the attack vector is inferred to be authenticated and local. An attacker can read or alter files in restricted directories once the create_symlinks permission is combined with read/write access in a directory where those operations are denied.