EUVD-2026-63713
GHSA-h64p-8h4r-6gfh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Public shares require no authentication (PR:N); canonical path prefix constraint limits viable targets (AC:H); impact is read-only file disclosure outside share boundary (C:H, I:N, A:N).
Primary rating from Vendor (https://github.com/drakkan/sftpgo).
CVSS VectorVendor: https://github.com/drakkan/sftpgo
Lifecycle Timeline
1DescriptionCVE.org
Summary
The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's canonical path begins with the shared directory's name.
Patches
Fixed in v2.7.3. The fix replaces the raw prefix check with a directory-boundary-aware check.
Articles & Coverage 1
AnalysisAI
Path traversal in SFTPGo's public web-client partial ZIP download endpoint allows unauthenticated remote attackers to read files located outside a browsable share's directory boundary. The flaw exists because the endpoint validated file entries using a raw string prefix check rather than a directory-boundary-aware comparison - a crafted request can escape the share root by supplying paths whose canonical form begins with the shared directory name but resolves to a parent or sibling path. Affected versions prior to v2.7.3 are vulnerable; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
SFTPGo (pkg:go/github.com_drakkan_sftpgo_v2) is an open-source, feature-rich file transfer server written in Go supporting SFTP, FTP/S, WebDAV, and an HTTP web-client interface. The vulnerability resides in the web-client endpoint that generates partial ZIP archives for browsable public shares. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) applies: the server evaluated whether a client-supplied file entry belonged to the share by checking whether the entry's canonical path string started with the shared directory name, rather than verifying directory containment via a proper separator-aware boundary check. This classic 'prefix bypass' pattern allows an attacker to name a path such that its canonical form starts with e.g. '/shares/data' but actually resolves to '/shares/data-secret/file.txt', satisfying the prefix check while escaping the intended directory boundary.
RemediationAI
Upgrade SFTPGo to version 2.7.3 or later, which replaces the raw string prefix check with a directory-boundary-aware path confinement check. The fix is documented in the GitHub Security Advisory GHSA-h64p-8h4r-6gfh (https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh). If an immediate upgrade is not possible, the most effective compensating control is to disable public (unauthenticated) browsable shares entirely - this removes the vulnerable endpoint from the attack surface with no impact on authenticated user sessions. Alternatively, restrict network access to the SFTPGo web-client port to trusted IP ranges via firewall rules, limiting exposure to internal networks where path enumeration is harder. Note that restricting network access does not eliminate the vulnerability if internal threat actors or compromised hosts are a concern; patching remains the definitive fix.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a p
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitra
An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfi
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers fo
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provid
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud meta
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, crea
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today