CVE-2026-49244: 
Wolfi vulnerability analysis and mitigation

CVE-2026-49244 is a path traversal vulnerability (CWE-22) in SFTPGo, an open-source SFTP/FTP/WebDAV server, affecting the public web-client endpoint used for partial ZIP downloads of browsable shares. The flaw allows unauthenticated network attackers to read files outside the intended shared directory if the target file's canonical path begins with the shared directory's name. It affects SFTPGo versions 2.2.0 through 2.7.1 (Go module github.com/drakkan/sftpgo/v2) and was published on May 30, 2026, with the advisory added to the GitHub Advisory Database on July 2, 2026. The CVSS v3.1 base score is 5.9 (Medium) (GitHub Advisory, SFTPGo Advisory).

The root cause is an improper path confinement check (CWE-22) in the partial ZIP download endpoint of SFTPGo's public web-client share feature. The server validated that a client-supplied file path began with the shared directory's name using a raw string prefix check, rather than a directory-boundary-aware comparison. This means an attacker could craft a path such as /shared_dir_name_extra/../../sensitive_file where the canonical path starts with the shared directory's name string but resolves to a location outside it. The fix in v2.7.3 replaces the raw prefix check with a proper directory-boundary-aware check to ensure paths are truly confined within the share (GitHub Advisory, SFTPGo Advisory).

Successful exploitation allows an unauthenticated attacker with network access to a public SFTPGo share to read arbitrary files on the server's filesystem, provided the target file's canonical path begins with the shared directory's name. The impact is limited to confidentiality — there is no integrity or availability impact. Sensitive files such as configuration files, credentials, or private data stored on the server could be exfiltrated, potentially enabling further lateral movement or privilege escalation (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is 0.057% (18th percentile), indicating a low near-term exploitation probability. The vulnerability requires no authentication and no user interaction, but attack complexity is rated High due to the specific path-naming precondition (the target's canonical path must begin with the shared directory's name). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was discovered and reported by researcher celinke97 (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible SFTPGo instance (versions 2.2.0–2.7.1) with a browsable public share enabled, using tools like Shodan or direct URL enumeration.
2. Identify shared directory name: Browse the public share to determine the name of the shared directory (e.g., /shared).
3. Craft malicious path: Construct a file path for the ZIP download request where the canonical path starts with the shared directory's name but resolves outside it — for example, targeting a file at /shared_extra/../../../etc/passwd or a sibling directory whose name begins with the share name.
4. Send crafted ZIP download request: Submit an HTTP request to the partial ZIP download endpoint of the public share, supplying the crafted path as the file entry parameter.
5. Retrieve sensitive file: The server's raw prefix check passes (the path starts with the share directory name), and the file outside the share boundary is included in the returned ZIP archive, which the attacker downloads and extracts (GitHub Advisory, SFTPGo Advisory).

• Network: Unusual HTTP POST/GET requests to the SFTPGo public share ZIP download endpoint containing file path parameters with directory traversal sequences (e.g., ../, %2e%2e%2f) or paths referencing directories outside the share.
• Logs: SFTPGo access logs showing requests to the partial ZIP download endpoint with file entries whose resolved paths fall outside the configured share directory; repeated requests from the same IP targeting different path variations.
• File System: ZIP archives downloaded from the server containing files not belonging to the shared directory (detectable via server-side logging of file access events if audit logging is enabled).

Upgrade SFTPGo to version 2.7.3 or later, which replaces the vulnerable raw prefix check with a directory-boundary-aware path confinement check. No configuration-based workaround is documented; the recommended action is to apply the patch immediately. As an interim measure, administrators may consider disabling public browsable shares or restricting network access to the SFTPGo web-client endpoint until the upgrade can be applied (GitHub Advisory, SFTPGo Advisory).

A technical write-up by the reporter (celinke97) was published on Medium, titled "When a Prefix Looks Like a Boundary: A Public Share Path Traversal in SFTPGo (CVE-2026-49244)," providing a detailed explanation of the vulnerability mechanics. No significant vendor statements beyond the GitHub security advisory or broader media coverage have been identified at this time (Feedly).