mediumCVSS 5.9Vulnerability
CVE-2026-49244
## Summary The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's canonical path begins with the shared directory's name. ## Patches Fixed in v2.7.3. The fix replaces the raw prefix check with a directory-boundary–aware check.
Properties
- ghsa_id
- GHSA-h64p-8h4r-6gfh
- severity
- medium
- summary
- SFTPGo has path confinement bypass in public browsable share partial ZIP download
- cvss_score
- 5.9
- cve_id
- CVE-2026-49244
- cvss_vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- is_ghsa_only
- false
- ghsa_published
- 2026-07-02T19:09:13Z
- source_url
- https://github.com/advisories/GHSA-h64p-8h4r-6gfh
- ghsa_updated
- 2026-07-02T19:10:30Z
Related Entities (4)
VULNERABLE_TO (1)
←[Software]go/github.com/drakkan/sftpgo/v2
AFFECTS (1)
→[Software]go/github.com/drakkan/sftpgo/v2
HAS_WEAKNESS (1)
→[Weakness]Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph