{"id":"GHSA-wwv9-g5x4-966q","revision":"ea85cfa8ff6a43419c4044b86e22d880","records":[{"revision":"ea85cfa8ff6a43419c4044b86e22d880","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wwv9-g5x4-966q","aliases":["CVE-2026-103028","GO-2026-6802"],"title":"SFTPGo source-side file-pattern filter bypass during copy operations","description":"### Summary\n\nFile pattern filters (`denied_patterns` / `allowed_patterns`) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied.\n\n### Details\n\nAn authenticated user can read the contents of files that the file pattern filters are configured to deny them. Nothing else is bypassed: the home directory, the virtual folder layout and the per-directory permissions are all still enforced, and both ends of the copy are paths the account can already reach. No access to other accounts and no administrative capability.","state":0,"publishedAt":"2026-10-15T20:22:10+00:00","modifiedAt":"2026-10-19T21:41:22.5134521+00:00","affected":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.5.0"},{"kind":"fixed","version":"2.7.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q","https://nvd.nist.gov/vuln/detail/CVE-2026-103028","https://github.com/drakkan/sftpgo/commit/dc8886bc079094b4ac2338df683f358b7676b5eb","https://github.com/drakkan/sftpgo","https://github.com/drakkan/sftpgo/releases/tag/v2.7.6"],"sourceUrl":"https://github.com/advisories/GHSA-wwv9-g5x4-966q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wwv9-g5x4-966q","identifiers":["GHSA-wwv9-g5x4-966q","CVE-2026-103028","GO-2026-6802"]},"retained":false,"historicalAffected":[]}],"coverage":[]}