ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-103028

SFTPGo is an open source, event-driven file transfer solution.

Published Oct 13, 2026 · catalog updated Oct 15, 2026 · SFTPGo is an open

Check if you run it

No confirmed exploitation is on record for CVE-2026-103028. EPSS is 0.22%. Act only if a listed version of SFTPGo is an open is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (SFTPGo is an open).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.22%
Remediation
Version ranges on file
Affected products
go github.com/drakkan/sftpgo/v2 · golang github.com

### Summary File pattern filters ( / ) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. ### Details An authenticated user can read the contents of files that the file pattern filters are configured to deny them. Nothing else is bypassed: the home directory, the virtual folder layout and the per-directory permissions are all still enforced, and both ends of the copy are paths the account can already reach. No access to other accounts and no administrative capability.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • go github.com/drakkan/sftpgo/v2>= 2.5.0, <= 2.7.5
  • golang github.comversion unspecified

How to fix CVE-2026-103028

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-103028. EPSS is 0.22%. Act only if a listed version of SFTPGo is an open is installed.

Which versions are affected?

Compare what you have installed with >= 2.5.0, <= 2.7.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.22%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce rest

  2. Oct 14, 2026 · NIST NVD

    Updated

    SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce rest

  3. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary File pattern filters ( / ) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as mis

Sources

  • CVE.orgVulnerability recordCVE-2026-103028

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-103028

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-wwv9-g5x4-966q

    SFTPGo source-side file-pattern filter bypass during copy operations

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-103028

    File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a f

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-103028

    SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.