Is CVE-2026-49244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49244 being exploited in the wild.

How severe is CVE-2026-49244?

Medium severity, with a CVSS score of 5.9, published 20 August 2026.

Which products and versions are affected?

github.com/drakkan/sftpgo (Go) SEMVER:introduced=0; github.com/drakkan/sftpgo/v2 (Go) >= 2.2.0, <= 2.7.1, SEMVER:introduced=2.2.0,fixed=2.7.3.

Is there a fix for CVE-2026-49244?

Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49244 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-49244?

Check whether you run github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49244: SFTPGo path confinement bypass in public share ZIP download

Q: Is there a fix for CVE-2026-49244?

Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49244 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-49244?

Check whether you run github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49244 · Severity: medium · CVSS 5.9 · Published 2026-08-20

SFTPGo, a full-featured storage routing and file transfer service, contains a vulnerability in its public file-sharing feature. An unauthorized user can bypass security restrictions to download files located outside of a shared folder if they know the specific naming structure of the target files. This could lead to the unauthorized exposure of sensitive system or user data.

Technologies: github.com/drakkan/sftpgo (Go), github.com/drakkan/sftpgo/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-49244 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49244 being exploited in the wild.
How severe is CVE-2026-49244?: Medium severity, with a CVSS score of 5.9, published 20 August 2026.
Which products and versions are affected?: github.com/drakkan/sftpgo (Go) SEMVER:introduced=0; github.com/drakkan/sftpgo/v2 (Go) >= 2.2.0, <= 2.7.1, SEMVER:introduced=2.2.0,fixed=2.7.3.
Is there a fix for CVE-2026-49244?: Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49244 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49244?: Check whether you run github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.3 or later
```
go get github.com/drakkan/sftpgo/v2@v2.7.3
```

Technical details

A path traversal vulnerability (CWE-22) exists in SFTPGo's public web-client endpoint responsible for partial ZIP downloads of browsable shares. The root cause is an insufficient validation check that used a raw prefix comparison rather than a directory-boundary-aware check when processing client-supplied file entries. An attacker can exploit this by requesting files where the canonical path begins with the shared directory's name but resides outside of it (e.g., accessing 'shared_data_secret' when only 'shared_data' was intended to be shared). The attack requires no authentication but has high complexity as the attacker must predict or know the naming of paths adjacent to the share. The issue is fixed in version 2.7.3.

Affected products

drakkan SFTPGo >= 2.2.0, <= 2.7.1

Identifiers

CVE-2026-49244
GHSA-h64p-8h4r-6gfh
GO-2026-5902

Timeline

2026-05-30: disclosed: Initial disclosure by drakkan
2026-07-02: advisory: GitHub Advisory published
2026-07-02: patched: Fixed in version 2.7.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.