GHSA-vj7w-3m8c-6vpx

SFTPGo has insufficient sanitization of user provided rsync command

Source: GitHub Advisory Database (reviewed) High CVE-2025-24366

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/drakkan/sftpgo/v2	>= 0.9.5, < 2.6.5	2.6.5
Go	github.com/drakkan/sftpgo	<= 1.2.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. ### Patches This issue was fixed in version v2.6.5 by checking the client provided arguments. https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1

References

External links from the advisory. They lead to third-party sites.