CVE-2026-49244
Description
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.
How to fix
- github.com/drakkan/sftpgo/v22.7.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/drakkan/sftpgo/v2Go | 2.2.0 ≤ v < 2.7.3 | 2.7.3 |
| github.com/drakkan/sftpgoGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.