CVE-2026-49244: SFTPGo has path confinement bypass in public browsable share partial ZIP download

The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target’s canonical path begins with the shared directory’s name.