CVE-2026-103028 in SFTPGo
Summary
by MITRE • 10/13/2026
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
SFTPGo serves as a robust open-source file transfer solution designed for secure data exchange over SFTP protocols. However, within versions ranging from 2.5.0 through 2.7.6, the application exhibits a critical logic flaw in its access control mechanisms that allows authenticated users to bypass intended security restrictions regarding file visibility and content protection. This vulnerability stems from an asymmetry in how pattern-based filters are applied during different operations. Specifically, while write or copy actions enforce destination path constraints effectively, read operations such as copying files do not validate the source against denied_patterns or allowed_patterns lists. Consequently, a user possessing standard copy permissions can extract sensitive data by selecting a file that is explicitly blocked from viewing due to its name matching a deny list or residing outside an allow-listed directory structure, provided they specify a destination path that complies with all access rules.
The technical root cause of this issue lies in the incomplete implementation of security checks for source validation during copy operations. The software correctly evaluates whether the target location is permissible but fails to verify if the source file itself should be accessible to the initiating user. This oversight creates a significant information disclosure vector where restricted content can be duplicated into an allowed directory, effectively rendering access controls useless for those specific files. Furthermore, this flaw extends beyond simple single-file copies; recursive directory operations allow attackers to replicate entire structures of restricted contents under permitted paths. Additionally, the hide policy mechanism is circumvented because files that are intentionally obscured from standard stat calls and directory listings remain accessible via copy commands, allowing an attacker to retrieve data that should be invisible within normal browsing contexts.
From a security impact perspective, this vulnerability compromises the confidentiality integrity of stored data by enabling unauthorized access to restricted information without requiring privilege escalation or administrative rights. The attack aligns with CWE-200, which classifies exposure of sensitive information through improper access controls, and maps directly to MITRE ATT&CK technique T1530, Data from Local System Retrieval, as it involves an authenticated actor extracting data that they are not supposed to see or possess. Although the vulnerability is limited by the requirement for authentication and specific copy permissions, its potential impact is severe in environments where sensitive files are protected solely through naming conventions or directory isolation rather than strict file-level access control lists. The persistence of this issue across multiple minor versions indicates a systemic gap in the validation logic that could be exploited repeatedly until patched.
Mitigation strategies primarily involve upgrading to version 2.7.6 or later, which resolves these logical flaws by ensuring that source files are subject to the same pattern-based evaluations as destination paths during copy operations. Until an upgrade is feasible, administrators should implement compensating controls such as restricting file permissions at the operating system level rather than relying solely on application-level patterns. Additionally, monitoring for unusual bulk download activities or recursive directory copies can help detect exploitation attempts in real-time. It is also advisable to review and tighten hide policies and ensure that sensitive data does not rely exclusively on obfuscation through naming conventions, as these measures are insufficient against this specific logic error. Maintaining strict adherence to the principle of least privilege ensures that even if such vulnerabilities exist, their impact remains contained within minimal operational boundaries.