SFTPGo source-side file-pattern filter bypass during copy operations

影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6

File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…

GitHub Advisory Databaseで読む

2026/10/16 05:22、GitHub Advisory Databaseが「SFTPGo source-side file-pattern filter bypass during copy operations」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub。CVE: CVE-2026-103028。