{"id":"ghsa-ghsa-wwv9-g5x4-966q","seq":2464,"kind":"advisory","title":"SFTPGo source-side file-pattern filter bypass during copy operations","url":"https://github.com/advisories/GHSA-wwv9-g5x4-966q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-wwv9-g5x4-966q","summary":"影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6\nSummary File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-103028"],"tags":["GHSA-wwv9-g5x4-966q","github.com/drakkan/sftpgo/v2"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-15T20:22:10.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}