# CVE-2026-49244: SFTPGo path confinement bypass in public share ZIP download

Source: https://junglewise.ai/threats/cve-2026-49244-sftpgo-path-confinement-bypass-in-public-share-zip-download  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-49244 · Severity: medium · CVSS 5.9 · Published 2026-08-20

SFTPGo, a full-featured storage routing and file transfer service, contains a vulnerability in its public file-sharing feature. An unauthorized user can bypass security restrictions to download files located outside of a shared folder if they know the specific naming structure of the target files. This could lead to the unauthorized exposure of sensitive system or user data.

Technologies: [github.com/drakkan/sftpgo (Go)](https://junglewise.ai/threats/technologies/github-com-drakkan-sftpgo), [github.com/drakkan/sftpgo/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-drakkan-sftpgo-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-49244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49244 being exploited in the wild.

**How severe is CVE-2026-49244?** Medium severity, with a CVSS score of 5.9, published 20 August 2026.

**Which products and versions are affected?** github.com/drakkan/sftpgo (Go) SEMVER:introduced=0; github.com/drakkan/sftpgo/v2 (Go) >= 2.2.0, <= 2.7.1, SEMVER:introduced=2.2.0,fixed=2.7.3.

**Is there a fix for CVE-2026-49244?** Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49244 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49244?** Check whether you run github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.3 or later

  ```sh
  go get github.com/drakkan/sftpgo/v2@v2.7.3
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in SFTPGo's public web-client endpoint responsible for partial ZIP downloads of browsable shares. The root cause is an insufficient validation check that used a raw prefix comparison rather than a directory-boundary-aware check when processing client-supplied file entries. An attacker can exploit this by requesting files where the canonical path begins with the shared directory's name but resides outside of it (e.g., accessing 'shared_data_secret' when only 'shared_data' was intended to be shared). The attack requires no authentication but has high complexity as the attacker must predict or know the naming of paths adjacent to the share. The issue is fixed in version 2.7.3.

## Affected products

- drakkan SFTPGo >= 2.2.0, <= 2.7.1

## Identifiers

- CVE-2026-49244
- GHSA-h64p-8h4r-6gfh
- GO-2026-5902

## Timeline

- 2026-05-30: disclosed: Initial disclosure by drakkan
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Fixed in version 2.7.3

## References

- [https://api.github.com/users/celinke97](https://api.github.com/users/celinke97)
- [https://github.com/celinke97](https://github.com/celinke97)
- [https://api.github.com/users/celinke97/gists%7B/gist_id%7D](https://api.github.com/users/celinke97/gists%7B/gist_id%7D)
- [https://api.github.com/users/celinke97/repos](https://api.github.com/users/celinke97/repos)
- [https://avatars.githubusercontent.com/u/176621958?v=4](https://avatars.githubusercontent.com/u/176621958?v=4)
- [https://api.github.com/users/celinke97/events%7B/privacy%7D](https://api.github.com/users/celinke97/events%7B/privacy%7D)

## Related threats

- [SFTPGo denial of service via malformed SSH channel request](https://junglewise.ai/threats/cve-2026-77375-sftpgo-denial-of-service-via-malformed-ssh-channel-request)
- [SFTPGo source-side file-pattern filter bypass during copy operations](https://junglewise.ai/threats/cve-2026-103028-sftpgo-source-side-file-pattern-filter-bypass-during-copy)
- [SFTPGo stored XSS via inline parameter in file downloads](https://junglewise.ai/threats/cve-2026-49245-sftpgo-stored-xss-via-inline-parameter-in-file-downloads)
- [GO-2026-4697 - SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo](https://junglewise.ai/threats/cve-2026-30915-sftpgo-improperly-sanitizes-placeholders-in-group-home)
- [SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy](https://junglewise.ai/threats/cve-2026-30914-sftpgo-vulnerable-to-path-traversal-and-permission-bypass-via)