CVE-2026-103028

Katalog CVE

CVSS 4.3 · Medium

Kerentanan Incorrect Authorization. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/drakkan/sftpgo/commit/dc8886bc079094b4ac2338df683f358b7676b5eb
• https://github.com/drakkan/sftpgo/releases/tag/v2.7.6
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q