GHSA-wwv9-g5x4-966q
Suggest an improvement- Source
- https://github.com/advisories/GHSA-wwv9-g5x4-966q
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-wwv9-g5x4-966q/GHSA-wwv9-g5x4-966q.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-wwv9-g5x4-966q
- Aliases
- Published
- 2026-10-15T20:22:10Z
- Modified
- 2026-10-15T20:30:03Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- SFTPGo source-side file-pattern filter bypass during copy operations
- Details
-
Summary
File pattern filters (
denied_patterns/allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied.Details
An authenticated user can read the contents of files that the file pattern filters are configured to deny them. Nothing else is bypassed: the home directory, the virtual folder layout and the per-directory permissions are all still enforced, and both ends of the copy are paths the account can already reach. No access to other accounts and no administrative capability.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-10-15T20:22:10Z", "nvd_published_at": "2026-10-13T15:17:30Z", "severity": "MODERATE" }- References
Affected packages
Go / github.com/drakkan/sftpgo/v2
Package
- Name
- github.com/drakkan/sftpgo/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/drakkan/sftpgo/v2