CVE-2026-49244 drakkan CVE debrief

Who should care

Users of SFTPGo, especially those with public shares exposed, should prioritize patching to prevent potential data disclosure. This includes organizations using SFTPGo for file transfer and those with public shares exposed to the internet. Security teams and vulnerability management teams should also be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

SFTPGo has a vulnerability in the public web-client partial ZIP download endpoint for browsable shares. An unauthenticated requester can select a canonical path outside the shared directory, disclosing the contents of out-of-scope files. This issue is fixed in version 2.7.3. The vulnerability allows an attacker to access files outside the shared directory, potentially leading to data disclosure. The endpoint validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. This issue was introduced in version 2.2.0 and fixed in version 2.7.3.

Defensive priority

Organizations using SFTPGo should prioritize patching to prevent potential data disclosure.

Recommended defensive actions

• Apply the patch from version 2.7.3 or later
• Restrict access to public shares
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in SFTPGo. Evidence is based on official records. The vulnerability allows an unauthenticated requester to select a canonical path outside the shared directory, disclosing the contents of out-of-scope files. Defenders should verify affected SFTPGo deployments, review official advisories, and plan vendor-supported updates or mitigations. They should also review compensating controls for exposed systems and check relevant monitoring, detection, and logs for exposed assets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.