## SFTPGo source-side file-pattern filter bypass during copy operations

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-103028
- 公開日時: 2026-10-15T20:22:10.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-wwv9-g5x4-966q)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-wwv9-g5x4-966q

影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6
Summary File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…