CVE-2025-24366

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-243678.8Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template CVE-2025-243687.5Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly c CVE-2025-243692.3Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challeng CVE-2025-243709.3Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to pytho CVE-2025-243717.1CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send CVE-2025-243727.3CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could po CVE-2025-243736.5woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slip CVE-2025-243744.3Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the oper CVE-2025-243755.0Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or p CVE-2025-243766.5kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, Admission CVE-2025-243777.8Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection CVE-2025-243787.8Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection