CVE-2026-10031 drakkan CVE debrief

Who should care

Administrators and users of SFTPGo, especially those with multi-user environments or sensitive data stored, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating access controls, monitoring for suspicious activity, and applying patches or updates as available. Additionally, users should consider implementing compensating controls such as file system access monitoring and logging to detect and respond to potential exploitation attempts. It is also essential to restrict create_symlinks permission to necessary users and monitor its usage to prevent unauthorized access or modification of files in restricted directories. By taking these steps, organizations can help protect their SFTPGo installations from potential exploitation of this vulnerability. Furthermore, it is crucial to inventory SFTPGo installations and verify version 2.7.4 or later is deployed to ensure that the patched version is used. Overall, a comprehensive approach to vulnerability management, including regular updates, monitoring, and access control, can help mitigate the risk associated with this vulnerability. Users with questions or concerns should consult the official CVE record or vendor advisories for more information. Those affected should prioritize patching or mitigating this vulnerability based on their specific environment and risk profile. The goal is to prevent attackers from exploiting the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. Effective mitigation requires a thorough understanding of the vulnerability, its potential impact, and the implementation of appropriate controls to prevent exploitation. By taking proactive steps to address this vulnerability, organizations can help protect their systems and data from potential harm. In addition to patching, users should consider reviewing compensating controls, such as file system access monitoring and logging, to detect and respond to potential exploitation attempts. This

Technical summary

CVE-2026-10031 is a permission bypass vulnerability in SFTPGo versions prior to 2.7.4. Authenticated users with create_symlinks permission can create symbolic links in permitted directories to access or modify files in restricted directories. The vulnerability exists because operations are authorized against the link's directory permissions rather than the target's directory permissions. This can lead to unauthorized file access or modification, potentially allowing attackers to read or write files in restricted directories. To mitigate this vulnerability, it is essential to restrict create_symlinks permission to necessary users, monitor its usage, and implement compensating controls such as file system access monitoring and logging. Additionally, reviewing and updating access controls for SFTPGo directories and files, as well as applying vendor-provided patches or updates, can help prevent exploitation. It is crucial for administrators and users of SFTPGo, especially those with multi-user environments or sensitive data stored, to be aware of this vulnerability and take steps to mitigate it.

Defensive priority

Authenticated users with create_symlinks permission can bypass per-directory access controls by creating symbolic links to files in restricted directories, allowing for unauthorized file access or modification.

Recommended defensive actions

• Inventory SFTPGo installations and verify version 2.7.4 or later is deployed.
• Restrict create_symlinks permission to necessary users and monitor its usage.
• Implement compensating controls such as file system access monitoring and logging.
• Review and update access controls for SFTPGo directories and files.
• Apply vendor-provided patches or updates as available.

Evidence notes

The CVE-2026-10031 record indicates a permission bypass vulnerability in SFTPGo prior to version 2.7.4. Authenticated users can create symbolic links in permitted directories to access files in restricted directories. The vulnerability relies on the create_symlinks permission and read/write access in one directory to affect operations in other directories.

Official resources