FKIE_CVE-2026-49244

Vulnerability from fkie_nvd - Published: 2026-08-20 22:17 - Updated: 2026-10-18 20:10
Severity
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.
References
security-advisories@github.comhttps://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f
security-advisories@github.comhttps://github.com/drakkan/sftpgo/releases/tag/v2.7.3
security-advisories@github.comhttps://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sftpgo",
          "vendor": "drakkan",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.0 \u003c 2.7.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory\u0027s name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3."
    },
    {
      "lang": "es",
      "value": "SFTPGo es una soluci\u00f3n de transferencia de archivos de c\u00f3digo abierto e impulsada por eventos. Desde la versi\u00f3n 2.2.0 hasta la 2.7.3, el punto final de descarga parcial de ZIP del cliente web p\u00fablico para un recurso compartido navegable valida las entradas de archivos proporcionadas por el cliente con una comparaci\u00f3n de prefijo de bytes en bruto en lugar de una verificaci\u00f3n consciente de los l\u00edmites del directorio. Un solicitante no autenticado que puede acceder a un recurso compartido p\u00fablico puede seleccionar una ruta can\u00f3nica fuera del directorio compartido cuando la ruta de destino comienza con el nombre del directorio compartido, como una ruta hermana que comparte el mismo prefijo. El punto final incluye entonces el archivo fuera de alcance en la descarga generada, revelando su contenido. Este problema est\u00e1 corregido en la versi\u00f3n 2.7.3."
    }
  ],
  "id": "CVE-2026-49244",
  "lastModified": "2026-10-18T20:10:00.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49244",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T20:58:27.136909Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T22:17:19.947",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.