SFTPGo source-side file-pattern filter bypass during copy operations

影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6

File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…

Read on GitHub Advisory Database

On 10/16/2026, 05:22 AM, GitHub Advisory Database published "SFTPGo source-side file-pattern filter bypass during copy operations" (type: Advisory). Severity is "Medium" (medium). Related technologies: Go, GitHub. CVE: CVE-2026-103028.