{"id":"GO-2026-6802","revision":"77378ae311e94355b93ff696522e4d98","records":[{"revision":"77378ae311e94355b93ff696522e4d98","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6802","aliases":["CVE-2026-103028","GHSA-wwv9-g5x4-966q"],"title":"SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo","description":"SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo","state":0,"publishedAt":"2026-10-19T21:08:35+00:00","modifiedAt":"2026-10-19T21:31:38.3098428+00:00","affected":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.5.0"},{"kind":"fixed","version":"2.7.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q","https://nvd.nist.gov/vuln/detail/CVE-2026-103028","https://github.com/drakkan/sftpgo/commit/dc8886bc079094b4ac2338df683f358b7676b5eb","https://github.com/drakkan/sftpgo/releases/tag/v2.7.6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6802","license":"OSV · upstream source license applies","key":"osv:GO-2026-6802","identifiers":["GO-2026-6802","CVE-2026-103028","GHSA-wwv9-g5x4-966q"]},"retained":false,"historicalAffected":[]}],"coverage":[]}