Skip to content
OpenAdvisories

Vendor

drakkan

13 known vulnerabilities.

Products

sftpgo 13
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-49245

    SFTPGo: Stored XSS via inline parameter on public shares and user file download

    SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controll…

    drakkan sftpgo github.com/drakkan/sftpgo github.com/drakkan/sftpgo/v2 Go