Executive brief
SFTPGo, a full-featured storage routing and file transfer service, contains a vulnerability in its public file-sharing feature. An unauthorized user can bypass security restrictions to download files located outside of a shared folder if they know the specific naming structure of the target files. This could lead to the unauthorized exposure of sensitive system or user data.
Technical details
A path traversal vulnerability (CWE-22) exists in SFTPGo's public web-client endpoint responsible for partial ZIP downloads of browsable shares. The root cause is an insufficient validation check that used a raw prefix comparison rather than a directory-boundary-aware check when processing client-supplied file entries. An attacker can exploit this by requesting files where the canonical path begins with the shared directory's name but resides outside of it (e.g., accessing 'shared_data_secret' when only 'shared_data' was intended to be shared). The attack requires no authentication but has high complexity as the attacker must predict or know the naming of paths adjacent to the share. The issue is fixed in version 2.7.3.
Affected products
- drakkan SFTPGo >= 2.2.0, <= 2.7.1
Timeline
- 2026-05-30: disclosed: Initial disclosure by drakkan
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Fixed in version 2.7.3