SFTPGo’s public web‑client partial ZIP download endpoint allowed unauthenticated callers to request file names that, although starting with the share’s directory name, referenced files outside the share, leading to disclosure of arbitrary files. The flaw stemmed from using a raw byte‑prefix comparison rather than a directory‑boundary‑aware check, so the download generator included out‑of‑scope content.

The vulnerability affected SFTPGo versions 2.2.0 through 2.7.2 inclusive for any instance exposing a public browsable share. The issue was fixed in release 2.7.3.

The CVSS score of 5.9 indicates moderate severity. The flaw is exploitable by any network user who can reach a public share; authentication is not required. EPSS data are not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known active exploitation at the time of analysis. Attackers could achieve confidential data disclosure by selecting sibling paths that share the share name prefix.