CVE-2026-49244: SFTPGo has path confinement bypass in public browsable share partial ZIP download

July 2, 2026

The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target’s canonical path begins with the shared directory’s name.

References

github.com/advisories/GHSA-h64p-8h4r-6gfh
github.com/drakkan/sftpgo/security/advisories/GHSA-h64p-8h4r-6gfh
nvd.nist.gov/vuln/detail/CVE-2026-49244

Code Behaviors & Features

Detect and mitigate CVE-2026-49244 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →