CVE-2026-49244

Received Received - Intake

Path Traversal in SFTPGo Web Client

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-49244

Affected Vendors & Products

Vendor	Product	Version / Range
sftpgo	sftpgo	From 2.2.0 (inc) to 2.7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

SFTPGo versions 2.2.0 to 2.7.3 have a flaw in the public web-client ZIP download feature for browsable shares. The endpoint checks file entries using raw byte-prefix comparison instead of verifying directory boundaries. This allows unauthenticated users to request files outside the intended shared directory if their paths share the same prefix as the shared directory.

Detection Guidance

Check SFTPGo version running on your system. If it is between 2.2.0 and 2.7.3, the system is vulnerable. No specific commands are provided in the context to detect exploitation attempts.

Impact Analysis

An attacker could access sensitive files stored outside the intended shared directory by exploiting this flaw. This could lead to unauthorized disclosure of confidential or proprietary data, depending on the file contents and system configuration.

Compliance Impact

This vulnerability could result in unauthorized data exposure, potentially violating GDPR (data protection), HIPAA (health information), or other privacy regulations. Organizations may face compliance penalties if sensitive data is leaked due to insufficient access controls.

Mitigation Strategies

Upgrade SFTPGo to version 2.7.3 or later immediately to patch the vulnerability. Ensure public shares are reviewed for unauthorized access and restrict share permissions to least privilege.

Hi! I’m here to help you understand CVE-2026-49244. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70