CVE-2024-52309

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in response to certain events. This feature is very common in all software similar to SFTPGo and is generally unrestricted. However, any SFTPGo administrator with permission to run a script has access to the underlying OS/container with the same permissions as the user running SFTPGo. This is unexpected for some SFTPGo administrators who think that there is a clear distinction between accessing the system shell and accessing the SFTPGo WebAdmin UI. To avoid this confusion, running system commands is disabled by default in 2.6.3, and an allow list has been added so that system administrators configuring SFTPGo must explicitly define which commands are allowed to be configured from the WebAdmin UI.

• CWE-20

• https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb
• https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7

Published

Nov 21, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52303aiohttp is an asynchronous HTTP client/server framework for …8.7
• CVE-2024-52304aiohttp is an asynchronous HTTP client/server framework for …7.5
• CVE-2024-52305UnoPim is an open-source Product Information Management (PIM…4.8
• CVE-2024-52306FileManager provides a Backpack admin interface for files an…9.8
• CVE-2024-52307authentik is an open-source identity provider. Due to the us…5.6
• CVE-2024-52308The GitHub CLI version 2.6.1 and earlier are vulnerable to r…9.6
• CVE-2024-5231A vulnerability was found in Campcodes Complete Web-Based Sc…6.5
• CVE-2024-52311Authentication tokens issued via Cognito in data.all are not…6.3
• CVE-2024-52312Due to inconsistent authorization permissions, data.all may …5.4
• CVE-2024-52313An authenticated data.all user is able to manipulate a getDa…5.3
• CVE-2024-52314A data.all admin team member who has access to the customer-…6.9
• CVE-2024-52316Unchecked Error Condition vulnerability in Apache Tomcat. If…9.8