drakkan has 5 CVEs on record. 4 were published in the last 90 days. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. Most affected products: sftpgo (3), github.com/drakkan/sftpgo/v2 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 4 prev 1
Worst active — by depth score
CVE-2026-77375Medium· 6.5SFTPGo is an open source, event-driven file transfer solution36CVE-2026-49244Medium· 5.9SFTPGo is an open source, event-driven file transfer solution33CVE-2026-10031Medium· 5.4SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where dow…30CVE-2026-103028Medium· 4.3SFTPGo is an open source, event-driven file transfer solution24CVE-2026-49245Low· 3.7SFTPGo is an open source, event-driven file transfer solution20
drakkan vulnerabilities
CVEs affecting drakkan, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-77375Medium· 6.5SFTPGo is an open source, event-driven file transfer solution
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and aff…
CVE-2026-103028Medium· 4.3SFTPGo is an open source, event-driven file transfer solution
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name…
CVE-2026-49244Medium· 5.9SFTPGo is an open source, event-driven file transfer solution
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison ra…
CVE-2026-49245Low· 3.7SFTPGo is an open source, event-driven file transfer solution
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowin…
CVE-2026-10031Medium· 5.4SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where dow…
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where dow…