The vulnerability in SFTPGo is a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing. This cause the server to treat normalized paths incorrectly, allowing an authenticated attacker to craft specific file paths that bypass folder‑level permissions or escape the boundaries of a configured Virtual Folder. The intrusion opportunity arises from the difference in path handling between protocol handlers and the internal virtual filesystem, which effectively lets an attacker access files beyond their authorized scope.

Affected vendor: drakkan. Product: SFTPGo. The issue applies to all releases prior to version 2.7.1, as noted in the advisory and the cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:* descriptor.

The CVSS score of 5.3 points to a medium severity risk. The EPSS score is reported as below 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. The attack vector is inferred to be an authenticated SFTP session where the attacker crafts malicious paths, taking advantage of the path normalization discrepancy to bypass authorization controls. The recommended mitigation is to upgrade to version 2.7.1 or later, which resolves the path handling issue.