{"id":"GHSA-h64p-8h4r-6gfh","summary":"SFTPGo has path confinement bypass in public browsable share partial ZIP download","details":"## Summary\n\nThe public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's canonical path begins with the shared directory's name.\n\n## Patches\n\nFixed in v2.7.3. The fix replaces the raw prefix check with a directory-boundary–aware check.","aliases":["CVE-2026-49244","GO-2026-5902"],"modified":"2026-07-07T16:11:20.865693370Z","published":"2026-07-02T19:09:13Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-02T19:09:13Z","nvd_published_at":null,"cwe_ids":["CWE-22"]},"references":[{"type":"WEB","url":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh"},{"type":"PACKAGE","url":"https://github.com/drakkan/sftpgo"}],"affected":[{"package":{"name":"github.com/drakkan/sftpgo/v2","ecosystem":"Go","purl":"pkg:golang/github.com/drakkan/sftpgo/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.7.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h64p-8h4r-6gfh/GHSA-h64p-8h4r-6gfh.json","last_known_affected_version_range":"\u003c= 2.7.1"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}