CVE-2025-24366

{
  "id": "CVE-2025-24366",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24366",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-07T22:49:03.247256Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "drakkan",
          "product": "sftpgo",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.9.5, < 2.6.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-02-07T22:15:14.463",
  "references": [
    {
      "url": "https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-vj7w-3m8c-6vpx",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "SFTPGo es una solución de transferencia de archivos basada en eventos y de código abierto. SFTPGo admite la ejecución de un conjunto definido de comandos a través de SSH. Además de un conjunto de comandos predeterminados, se pueden activar algunos comandos opcionales, uno de ellos es `rsync`. Está deshabilitado en la configuración predeterminada y está limitado al sistema de archivos local; no funciona con backends de almacenamiento remoto o en la nube. Debido a la falta de depuración del comando `rsync` proporcionado por el cliente, un usuario remoto autenticado puede usar algunas opciones del comando rsync para leer o escribir archivos con los permisos del proceso del servidor SFTPGo. Este problema se solucionó en la versión v2.6.5 al verificar los argumentos proporcionados por el cliente. Se recomienda a los usuarios que actualicen. No existen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T08:58:54.683",
  "sourceIdentifier": "security-advisories@github.com"
}