CVE-2026-77375

6.5 MEDIUMpublic exploit available

Published 2026-10-13 · Updated 2026-10-13

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-129

Public exploit & PoC references

https://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0
https://github.com/drakkan/sftpgo/releases/tag/v2.7.5
https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc

All references

https://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0
https://github.com/drakkan/sftpgo/releases/tag/v2.7.5
https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100654PoC
MEDIUMCVE-2026-100836PoC
UNSCOREDCVE-2026-102510
UNSCOREDCVE-2026-102511
LOWCVE-2026-102822PoC
MEDIUMCVE-2026-103220
MEDIUMCVE-2026-107211PoC
HIGHCVE-2026-107217PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.