EUVD-2026-63713
GHSA-h64p-8h4r-6gfh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Public shares require no authentication (PR:N); canonical path prefix constraint limits viable targets (AC:H); impact is read-only file disclosure outside share boundary (C:H, I:N, A:N).
Primary rating from Vendor (https://github.com/drakkan/sftpgo).
CVSS VectorVendor: https://github.com/drakkan/sftpgo
Lifecycle Timeline
1DescriptionCVE.org
Summary
The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's canonical path begins with the shared directory's name.
Patches
Fixed in v2.7.3. The fix replaces the raw prefix check with a directory-boundary-aware check.
Articles & Coverage 1
AnalysisAI
Path traversal in SFTPGo's public web-client partial ZIP download endpoint allows unauthenticated remote attackers to read files located outside a browsable share's directory boundary. The flaw exists because the endpoint validated file entries using a raw string prefix check rather than a directory-boundary-aware comparison - a crafted request can escape the share root by supplying paths whose canonical form begins with the shared directory name but resolves to a parent or sibling path. Affected versions prior to v2.7.3 are vulnerable; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
SFTPGo (pkg:go/github.com_drakkan_sftpgo_v2) is an open-source, feature-rich file transfer server written in Go supporting SFTP, FTP/S, WebDAV, and an HTTP web-client interface. The vulnerability resides in the web-client endpoint that generates partial ZIP archives for browsable public shares. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) applies: the server evaluated whether a client-supplied file entry belonged to the share by checking whether the entry's canonical path string started with the shared directory name, rather than verifying directory containment via a proper separator-aware boundary check. This classic 'prefix bypass' pattern allows an attacker to name a path such that its canonical form starts with e.g. '/shares/data' but actually resolves to '/shares/data-secret/file.txt', satisfying the prefix check while escaping the intended directory boundary.
RemediationAI
Upgrade SFTPGo to version 2.7.3 or later, which replaces the raw string prefix check with a directory-boundary-aware path confinement check. The fix is documented in the GitHub Security Advisory GHSA-h64p-8h4r-6gfh (https://github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh). If an immediate upgrade is not possible, the most effective compensating control is to disable public (unauthenticated) browsable shares entirely - this removes the vulnerable endpoint from the attack surface with no impact on authenticated user sessions. Alternatively, restrict network access to the SFTPGo web-client port to trusted IP ranges via firewall rules, limiting exposure to internal networks where path enumeration is harder. Note that restricting network access does not eliminate the vulnerability if internal threat actors or compromised hosts are a concern; patching remains the definitive fix.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today