{"id":"EUVD-2026-98780","enisaUuid":"a9122cef-e6a1-3b74-bccf-ba486b9e3d85","description":"SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.","datePublished":"Oct 13, 2026, 2:52:46 PM","dateUpdated":"Oct 13, 2026, 3:24:59 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc\nhttps://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0\nhttps://github.com/drakkan/sftpgo/releases/tag/v2.7.5\n","aliases":"CVE-2026-77375\nGHSA-q7pc-356p-hggc\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"cc2ef69a-e27d-31be-8c25-263dbbbb9643","product":{"name":"sftpgo","vendor":{"name":"drakkan"}},"product_version":"\u003c 2.7.5"}],"enisaIdVendor":[{"id":"c4309486-b297-361e-9313-a46642fc2691","vendor":{"name":"drakkan"}}],"enisaIdVulnerability":[{"id":"8b140180-5586-349d-9ae2-37b8c8b7fc85","vulnerability":{"id":"CVE-2026-77375","description":"SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.","datePublished":"Oct 13, 2026, 2:52:46 PM","dateUpdated":"Oct 13, 2026, 3:24:59 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc\nhttps://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0\nhttps://github.com/drakkan/sftpgo/releases/tag/v2.7.5\n","enisa_id":"EUVD-2026-98780\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 28, 2026, 7:15:15 AM","vulnerabilityProduct":[{"id":"b4b87ad4-f64a-301b-956b-45408eceafa7","product":{"name":"sftpgo","vendor":{"name":"drakkan"}},"product_version":"\u003c 2.7.5"}],"vulnerabilityVendor":[{"id":"aef35d2a-6849-3139-b0c3-1e34354d603b","vendor":{"name":"drakkan"}}]}},{"id":"e8704887-28ba-309d-8719-d414c7fff595","vulnerability":{"id":"GHSA-q7pc-356p-hggc","description":"SFTPGo: Denial of service via malformed SSH channel request","datePublished":"Oct 15, 2026, 8:14:20 PM","dateUpdated":"Oct 15, 2026, 8:14:20 PM","baseScore":0.0,"references":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77375\nhttps://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0\nhttps://github.com/drakkan/sftpgo\nhttps://github.com/drakkan/sftpgo/releases/tag/v2.7.5\n","enisa_id":"EUVD-2026-98780\n","aliases":"GHSA-q7pc-356p-hggc\nCVE-2026-77375\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}