SFTPGo source-side file-pattern filter bypass during copy operations

影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6

File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…

GitHub Advisory Database에서 읽기

2026. 10. 16. 오전 05:22, GitHub Advisory Database에서 "SFTPGo source-side file-pattern filter bypass during copy operations"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-103028.