PkgSeer

Vulnerability GHSA-h64p-8h4r-6gfh

Medium Risk

3 months ago

SFTPGo has path confinement bypass in public browsable share partial ZIP download

v2.2.0 - v2.7.2

Summary

SFTPGo has path confinement bypass in public browsable share partial ZIP download

Details

Summary

The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's canonical path begins with the shared directory's name.

Patches

Fixed in v2.7.3. The fix replaces the raw prefix check with a directory-boundary–aware check.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

SFTPGo source-side file-pattern filter bypass during copy operations

v2.5.0 - v2.7.5 GHSA-wwv9-g5x4-966q

SFTPGo: Denial of service via malformed SSH channel request

v2.0.0 - v2.7.4 GHSA-q7pc-356p-hggc

SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo

v2.2.0 - v2.7.2 GO-2026-5900

SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo

v2.2.0 - v2.7.2 GO-2026-5902

SFTPGo has stored XSS via inline parameter on public shares and user file download

v2.2.0 - v2.7.2 GHSA-3vcg-pv95-pq54

View all vulnerabilities for these packages

Impacted packages

github.com/drakkan/sftpgo/v2

Timeline

Published

3 months ago

Fixed (v2.7.3)

4 months ago

Last Modified

3 months ago