CVE-2026-49244 in SFTPGo
Summary
by MITRE • 08/21/2026
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
SFTPGo serves as an open-source, event-driven file transfer solution designed to facilitate secure data exchange over various protocols including SFTP and HTTP. Within this ecosystem, a critical security flaw was identified in the public web-client functionality, specifically affecting versions ranging from 2.2.0 through 2.7.3. The vulnerability resides in the endpoint responsible for handling partial ZIP downloads of browsable shares. This feature allows users to select specific files within a shared directory and download them as a compressed archive. However, the underlying implementation relies on a naive validation mechanism that compares client-supplied file entries using raw byte-prefix matching rather than implementing a robust directory-boundary-aware check.
The technical core of this vulnerability lies in how path traversal is evaluated during the ZIP creation process. When an unauthenticated requester accesses a public share and attempts to download files, the server checks if the requested canonical paths are within the allowed shared directory by verifying if they start with the same string prefix as the root of that share. This approach fails to account for directory separators or structural boundaries. Consequently, if a target path outside the intended scope begins with the exact name of the shared directory followed immediately by another character without a separator, it may pass this superficial check. For instance, if a public share is named "documents", a request targeting "/documents_backup/secret.txt" might be erroneously accepted because its canonical path starts with the string "documents". This logic error enables an attacker to bypass access controls and include files from sibling directories or other parts of the filesystem that are not intended for public exposure.
The operational impact of this vulnerability is significant, primarily manifesting as a directory traversal leading to unauthorized information disclosure. An unauthenticated actor who can reach the SFTPGo web interface can exploit this flaw to download sensitive files located outside the designated public share boundaries. This results in a breach of confidentiality, potentially exposing internal documents, configuration files, or other restricted data to external parties. The severity is heightened by the fact that no authentication is required for exploitation against publicly accessible shares, making it an attractive target for automated scanning and mass exploitation campaigns. From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as well as CWE-732: Incorrect Permission Assignment for Critical Resource. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1083: File and Directory Discovery, where an adversary explores the file system to locate valuable data before exfiltration.
To mitigate this risk, organizations running SFTPGo must upgrade immediately to version 2.7.3 or later, which implements a corrected validation mechanism that properly enforces directory boundaries using canonical path resolution rather than simple string prefix matching. For environments where an immediate upgrade is not feasible due to operational constraints, administrators should consider implementing network-level access controls such as firewall rules to restrict web interface access to trusted IP ranges only. Additionally, reviewing and tightening the configuration of public shares to ensure that no sensitive data resides in directories with names that could be confused for valid share prefixes can provide a layer of defense-in-depth. Regular security audits and penetration testing should also be conducted to verify that path traversal protections are functioning as intended across all file transfer endpoints.