CVE-2026-49244

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.3

Description A path confinement bypass exists in the public web-client endpoint used for partial ZIP downloads of browsable shares. The system failed to correctly restrict client-supplied file entries to the intended shared directory. This allows a requester to read files located outside the shared directory, provided the target's canonical path starts with the name of the shared directory.

Recommendations Update to version 2.7.3.