{"id":"GHSA-h64p-8h4r-6gfh","revision":"0c667b64374a481fa1d573bb6d7e8513","records":[{"revision":"0c667b64374a481fa1d573bb6d7e8513","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-h64p-8h4r-6gfh","aliases":["CVE-2026-49244","GO-2026-5902"],"title":"SFTPGo has path confinement bypass in public browsable share partial ZIP download","description":"## Summary\n\nThe public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's canonical path begins with the shared directory's name.\n\n## Patches\n\nFixed in v2.7.3. The fix replaces the raw prefix check with a directory-boundary–aware check.","state":0,"publishedAt":"2026-07-02T19:09:13+00:00","modifiedAt":"2026-07-07T16:11:33.2679685+00:00","affected":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.2.0"},{"kind":"fixed","version":"2.7.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh","https://github.com/drakkan/sftpgo"],"sourceUrl":"https://github.com/advisories/GHSA-h64p-8h4r-6gfh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h64p-8h4r-6gfh","identifiers":["GHSA-h64p-8h4r-6gfh","CVE-2026-49244","GO-2026-5902"]},"retained":false,"historicalAffected":[]}],"coverage":[]}