CVE-2026-10031: SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitt

mediumCVSS 4.2CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.2
Published: 2026-07-30
Last updated: 2026-07-31
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-10031

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-100310.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-10031	coverage & exploitation status	NVD · CVE.org

Recent advisories for SFTPGo

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

lowGHSA-3vcg-pv95-pq54: SFTPGo has stored XSS via inline parameter on public shares and user file downloadghsa · 2026-07-02
mediumGHSA-h64p-8h4r-6gfh: SFTPGo has path confinement bypass in public browsable share partial ZIP downloadghsa · 2026-07-02

CVE-2026-10031: SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitt

Details

Exploitation outlook

Referenced CVEs

Recent advisories for SFTPGo

More from NVD Recent CVEs