Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-10031 SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic link… https://www.cve.org/CVERecord?id=CVE-2026-10031
Post summary
The text announces a permission‑bypass vulnerability in SFTPGo versions prior to 2.7.4 that lets authenticated users create symbolic links to skirt per‑directory access controls.
🚨*CVE* CVE-2026-10031 SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic link… https://www.cve.org/CVERecord?id=CVE-2026-10031 ----- Traducción: CVE-2026-10031 SFT… http://infoflow.cloud`
Post summary
CVE-2026-10031 is a permission bypass flaw in SFTPGo (pre‑2.7.4) that lets authenticated users create symbolic links to bypass per‑directory access controls.