SFTPGo source-side file-pattern filter bypass during copy operations

影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6

File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…

在 GitHub Advisory Database 阅读

2026/10/16 05:22，GitHub Advisory Database 发布了“SFTPGo source-side file-pattern filter bypass during copy operations”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub。CVE：CVE-2026-103028。