File Transfer Solution Vulnerability in SFTPGo
CVE-2026-103028

4.3MEDIUM

Key Information:

Vendor

Drakkan

Status
Sftpgo
Vendor
CVE Published:
13 October 2026

What is CVE-2026-103028?

An authenticated user in SFTPGo versions 2.5.0 to 2.7.6 with copy permissions can bypass configured file-pattern filters. This allows them to copy restricted files to allowed destinations, enabling unauthorized access to denied file contents. The vulnerability arises from the way file-pattern filters are applied only to destination paths. Recursive directory copying can exploit this issue, allowing restricted files to appear accessible. While home-directory boundaries and existing permissions still apply, it creates potential unforeseen access issues. The issue was fixed in SFTPGo version 2.7.6.

Affected Version(s)

sftpgo >= 2.5.0, < 2.7.6

References

https://github.com/drakkan/sftpgo/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/drakkan/sftpgo/commit/dc8886bc079094b4...
x_refsource_MISC
https://github.com/drakkan/sftpgo/releases/tag/v2.7.6
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.