CVE-2026-49244

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49244", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-28T14:33:01.178Z", "datePublished": "2026-08-20T21:53:12.098Z", "dateUpdated": "2026-08-21T21:44:58.013Z"}, "containers": {"cna": {"title": "SFTPGo: Path confinement bypass in public browsable share partial ZIP download", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh"}, {"name": "https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f", "tags": ["x_refsource_MISC"], "url": "https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f"}, {"name": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.3"}], "affected": [{"vendor": "drakkan", "product": "sftpgo", "versions": [{"version": ">= 2.2.0 < 2.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:53:12.098Z"}, "descriptions": [{"lang": "en", "value": "SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3."}], "source": {"advisory": "GHSA-h64p-8h4r-6gfh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T20:58:27.136909Z", "id": "CVE-2026-49244", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:44:58.013Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49244", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T20:58:27.136909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T20:58:28.577Z"}}], "cna": {"title": "SFTPGo: Path confinement bypass in public browsable share partial ZIP download", "source": {"advisory": "GHSA-h64p-8h4r-6gfh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "drakkan", "product": "sftpgo", "versions": [{"status": "affected", "version": ">= 2.2.0 < 2.7.2"}]}], "references": [{"url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh", "name": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f", "name": "https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.3", "name": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:53:12.098Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49244", "state": "PUBLISHED", "dateUpdated": "2026-08-21T21:44:58.013Z", "dateReserved": "2026-05-28T14:33:01.178Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:53:12.098Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sftpgo", "vendor": "drakkan", "versions": [{"status": "affected", "version": ">= 2.2.0 < 2.7.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3."}, {"lang": "es", "value": "SFTPGo es una soluci\u00f3n de transferencia de archivos de c\u00f3digo abierto e impulsada por eventos. Desde la versi\u00f3n 2.2.0 hasta la 2.7.3, el punto final de descarga parcial de ZIP del cliente web p\u00fablico para un recurso compartido navegable valida las entradas de archivos proporcionadas por el cliente con una comparaci\u00f3n de prefijo de bytes en bruto en lugar de una verificaci\u00f3n consciente de los l\u00edmites del directorio. Un solicitante no autenticado que puede acceder a un recurso compartido p\u00fablico puede seleccionar una ruta can\u00f3nica fuera del directorio compartido cuando la ruta de destino comienza con el nombre del directorio compartido, como una ruta hermana que comparte el mismo prefijo. El punto final incluye entonces el archivo fuera de alcance en la descarga generada, revelando su contenido. Este problema est\u00e1 corregido en la versi\u00f3n 2.7.3."}], "id": "CVE-2026-49244", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49244", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T20:58:27.136909Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:17:19.947", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/drakkan/sftpgo/commit/52a56584c417e325aea35ab23849422a90ba512f"}, {"source": "security-advisories@github.com", "url": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sftpgo", "source": "cna", "vendor": "drakkan"}, "product": "sftpgo", "vendor": "drakkan"}], "created": "2026-08-21T00:30:07.428031+00:00", "updated": "2026-08-21T00:30:07.621251+00:00", "vendors": ["drakkan", "drakkan$PRODUCT$sftpgo"]}