Is CVE-2026-30915 actively exploited?

No active exploitation of CVE-2026-30915 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30915 be exploited remotely?

Yes. CVE-2026-30915 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-30915?

CVE-2026-30915 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-30915

MEDIUM

CVE-2026-30915

CWE-22Published: March 13, 2026· Updated: Mar 18, 2026

4.3

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:19.1th

Official Description

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory. This issue is fixed in version v2.7.1

NVD Source

Technical Analysis

CVE-2026-30915 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.