CVE-2026-103028
Deferred Deferred - Pending Action

Path Traversal in SFTPGo File Transfer Solution

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-103028
EUVD
EUVD-2026-98781

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
drakkan sftpgo >= 2.5.0, < 2.7.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SFTPGo allows an authenticated user with copy permission to bypass file-pattern restrictions. The system fails to properly check source files against denied_patterns or allowed_patterns during copy operations, enabling users to copy restricted files to allowed destinations and read their contents.

Impact Analysis

An attacker with valid credentials could access files they are not authorized to read by copying them to a permitted location. This could lead to data leaks, unauthorized information disclosure, or violation of access controls within the SFTPGo system.

Compliance Impact

This vulnerability could result in unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected SFTPGo versions may face compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade SFTPGo to version 2.7.6 or later to address the file-pattern filter bypass issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart