Read the docs
TI-2026-71832 Aliases CVE-2026-103028GHSA-wwv9-g5x4-966q

SFTPGo copy operations bypass source file pattern filters

Priority LOW 19CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

SFTPGo from 2.5.0 before 2.7.6 is affected. Its file pattern filters are checked only on the destination of a copy, which is an incorrect authorization flaw (CWE-863). An authenticated user with copy permission can copy a file denied by denied_patterns or outside allowed_patterns to an allowed name and then read its contents.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix Fixed sftpgo (drakkan): 2.7.6github.com/drakkan/sftpgo/v2 (Go): 2.7.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
drakkansftpgo2.5.0 to before 2.7.62.7.6Patch availableCNA
—github.com/drakkan/sftpgo/v2 (Go)2.5.0 to before 2.7.62.7.6Patch availableGHSA-wwv9-g5x4-966q
  • sftpgo Vendordrakkan Affected 2.5.0 to before 2.7.6 Fixed in 2.7.6 Patch available CNA
  • github.com/drakkan/sftpgo/v2 (Go) Vendor— Affected 2.5.0 to before 2.7.6 Fixed in 2.7.6 Patch available GHSA-wwv9-g5x4-966q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:*——drakkan
  • cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:* Versions — — ·drakkan

Remediation

Update SFTPGo to version 2.7.6, which fixes this issue. The Go module github.com/drakkan/sftpgo/v2 has fixed version 2.7.6.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA sftpgo (drakkan) Fixed in 2.7.6
  • Fix · GHSA-wwv9-g5x4-966q github.com/drakkan/sftpgo/v2 (Go) Fixed in 2.7.6 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-103028
  2. 2026-10-14 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-wwv9-g5x4-966q
  4. 2026-10-16 Fix available: Go/github.com/drakkan/sftpgo/[email protected] · GHSA-wwv9-g5x4-966q
  5. 2026-10-16 CVSS score added · GHSA-wwv9-g5x4-966q
  6. 2026-10-16 Weakness changed · GHSA-wwv9-g5x4-966q
  7. 2026-10-16 5 new references · GHSA-wwv9-g5x4-966q

References

Advisory 1

Other 4

  • TI-2022-16494 Recovery codes abuse in SFTPGo CVSS 3.1HIGH 8.3
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2025-18109 Insufficient sanitization of user provided rsync command in SFTPGo CVSS 3.1HIGH 7.5
  • TI-2026-71799 Denial of service in SFTPGo via malformed SSH channel request CVSS 3.1MEDIUM 6.5
  • TI-2022-18599 XSS Vulnerabilities in WebClient CVSS 3.1MEDIUM 6.1
  • TI-2026-36441 SFTPGo: Path confinement bypass in public browsable share partial ZIP download CVSS 3.1MEDIUM 5.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences