SFTPGo versions prior to 2.7.1 contain an input validation flaw when processing dynamic group paths such as home directories or key prefixes. Placeholders like %username% are replaced without strict sanitization of relative path components, enabling a specially crafted username to resolve the resulting path to a parent directory instead of the intended sub‑directory. This flaw is a classic directory traversal (CWE‑22) that could allow an attacker to read or write files outside the designated directory, potentially exposing confidential data.

The vulnerable product is drakkan:sftpgo. All releases before v2.7.1 are affected. The issue is resolved in version v2.7.1 and later; no other vendors or products are listed as affected.

The CVSS score is 5.3, indicating a moderate risk. EPSS is below 1%, suggesting a low probability of exploitation at present, and the vulnerability is not in the CISA KEV catalog. Exploitation requires the ability to create a user with a crafted username; the description does not specify the exact privilege level needed, but it is inferred that such an action must be performed through an interface that allows user creation. The likely attack vector is via the user management functionality of SFTPGo.