CVE-2026-103028
4.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Authenticated users with copy permissions can read restricted or hidden files by copying them to permitted paths. Attackers only need valid login credentials and copy privileges within their home directory or virtual folder.
Root cause
SFTPGo evaluates denied_patterns, allowed_patterns, and hide policy rules exclusively on copy destinations rather than verifying the source files.
Affected systems
SFTPGo 2.5.0 through versions prior to 2.7.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade SFTPGo to version 2.7.6 or later. If upgrading must wait, revoke copy permissions for users relying on denied_patterns, allowed_patterns, or hide policies.
$ sftpgo versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.