Threats tagged 'ghsa-wwv9-g5x4-966q'

CVE-2026-103028 is an authorization vulnerability in drakkan sftpgo versions 2.5.0 up to but not including 2.7.6. It allows an authenticated user with copy permissions to bypass file pattern filters that are intended to restrict access to certain files. By copying files denied by filters to permitted names or locations, the user can read contents of files that should be inaccessible according to the configured filters. Other access controls such as home directory restrictions, virtual folder layouts, and per-directory permissions remain enforced. There is no administrative privilege escalation or cross-account access.