Go/github.com/drakkan/sftpgo/v2 CVE-2024-37897: medium 6.5, EPSS 0.31%

SFTPGo has insufficient access control for password reset

Action: Upgrade github.com/drakkan/sftpgo/v2 to 2.6.1 or later.

go get github.com/drakkan/sftpgo/v2@v2.6.1

Affected

Fixed versions

Sources

• osv: GHSA-hw5f-6wvv-xcrh
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh
• https://nvd.nist.gov/vuln/detail/CVE-2024-37897
• https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423
• https://github.com/drakkan/sftpgo/commit/3462bba3f41cbc75486474991b9e3ac1b5f1e583
• https://github.com/drakkan/sftpgo
• https://github.com/drakkan/sftpgo/releases/tag/v2.6.1

CVE-2024-37897 · published 2024-06-20T16:11:48Z · modified 2026-09-10T03:50:15.638617984Z · JSON