Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-49244SFTPGo: Path confinement bypass in public browsable share partial ZIP download

Medium 5.9

In plain English

A medium-severity path traversal in sftpgo from drakkan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/drakkan/sftpgo	no fix listed	GO-2026-5902
Go	github.com/drakkan/sftpgo/v2	2.7.3	GO-2026-5902
Go	github.com/drakkan/sftpgo/v2	2.7.3	GHSA-h64p-8h4r-6gfh

Affected products (as reported)

Vendor	Product	Versions
drakkan	sftpgo	>= 2.2.0 < 2.7.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh x_refsource_CONFIRM
https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f x_refsource_MISC
https://github.com/drakkan/sftpgo/releases/tag/v2.7.3 x_refsource_MISC