The vulnerability arises from the SFTPGo file‑pattern filter being applied only to destination filenames during copy operations. An attacker who has authenticated access and copy permissions can cause a source file that matches denied_patterns or falls outside allowed_patterns to be copied to an allowed destination. The copy operation succeeds, and the attacker can then read the contents of the originally denied file. Recursive directory copies can duplicate restricted data under valid paths, and the hide policy is bypassed because files that appear missing are still copyable.

Drakkan SFTPGo, open‑source event‑driven file transfer solution. Versions from 2.5.0 up through 2.7.5 are vulnerable; the issue was addressed in the 2.7.6 release and later.

CVSS score is 4.3, indicating medium severity. EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires authentication; an attacker must log into the SFTPGo service with a user account that has copy permissions. Once authenticated, the attacker can copy a denied file to an allowed destination and access its content. No remote code execution or privilege escalation is possible, but the flaw permits unauthorized data disclosure.