Is github.com/drakkan/sftpgo safe ? github.com/drakkan/sftpgo (go) has 12 known vulnerabilities, the worst rated HIGH. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 55th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-vj7w-3m8c-6vpx, the advisory selected below
// 12 advisories GHSA-vj7w-3m8c-6vpx SFTPGo supports execution of a defined set of commands via SSH. HIGH GHSA-x8qh-7475-c5mp In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an… MODE GHSA-cf7g-cm7q-rq7f Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. MODE GHSA-wwv9-g5x4-966q SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo UNKN GHSA-q7pc-356p-hggc SFTPGo: Denial of service via malformed SSH channel request in github.com/drakkan/sftpgo UNKN GHSA-3vcg-pv95-pq54 SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo UNKN GHSA-h64p-8h4r-6gfh SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo UNKN GHSA-m83q-5wr4-4gfp SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo UNKN GHSA-6943-qr24-82vx sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo UNKN GHSA-49cc-xrjf-9qf7 SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo UNKN GHSA-54qx-8p8w-xhg8 SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo UNKN GHSA-hw5f-6wvv-xcrh SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo UNKN SFTPGo supports execution of a defined set of commands via SSH.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High // questions Is github.com/drakkan/sftpgo safe to install? CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for github.com/drakkan/sftpgo (go), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/drakkan/sftpgo have known vulnerabilities? Yes. CyberXYZ records 12 known vulnerabilities for github.com/drakkan/sftpgo (go), the worst rated HIGH. These include GHSA-vj7w-3m8c-6vpx, GHSA-x8qh-7475-c5mp, GHSA-cf7g-cm7q-rq7f, GHSA-wwv9-g5x4-966q, GHSA-q7pc-356p-hggc.
How do I check github.com/drakkan/sftpgo before installing? Search github.com/drakkan/sftpgo in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fdrakkan%2Fsftpgo . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:38 UTC. The most recent advisory here was published 2026-10-19. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page