SFTPGo EUVD-2026-63713

Exploitation requires three concurrent conditions: (1) the SFTPGo instance must have at least one public (unauthenticated) browsable share configured and accessible to the requester - private or authenticated-only shares are not affected; (2) the web-client HTTP interface must be reachable by the attacker, which is network-dependent; (3) the canonical path of the target file must begin with the shared directory's name, meaning the attacker must identify or predict a file in a directory whose name shares a prefix with the public share directory. Authentication is not required by design for public shares (PR:N in CVSS). Deployments where no public shares are configured, or where the web-client port is firewalled, are not exploitable.

The NVD-assigned CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a meaningful but conditionally exploitable information disclosure. The High attack complexity (AC:H) is grounded in the description's constraint: exploitation succeeds only when the target file's canonical path begins with the shared directory's name, narrowing the attack surface to predictable path structures (e.g., sibling directories sharing a name prefix). No EPSS score was provided in the source data, so exploitation probability cannot be quantified. No KEV listing exists, and no public POC has been identified - the real-world risk is therefore limited to opportunistic discovery or targeted exploitation by an attacker who can enumerate or predict directory layouts. The impact is confined to confidentiality (C:H) with no integrity or availability effect. Instances that expose public shares to the internet carry elevated risk; deployments where public shares are restricted to internal networks have substantially reduced exposure. The fix in v2.7.3 is a targeted code change replacing the prefix check with directory-boundary logic, lending high confidence to its completeness.

An attacker who discovers a public SFTPGo share (e.g., via web crawling or direct URL enumeration) submits a crafted partial ZIP download request to the web-client endpoint, supplying file entries whose paths are constructed so their canonical form begins with the shared directory name but traverses to a sibling directory - for instance, requesting '/shares/uploads/../uploads-internal/config.json' where 'uploads-internal' canonicalizes to a string starting with 'uploads'. The server's prefix check passes, and the file contents are returned in the ZIP response, exposing data outside the intended share boundary. No public POC has been identified, but the vulnerability class (path traversal via prefix bypass) is well-understood and reproducible from the advisory description alone.