Description
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| drakkan | sftpgo | < 2.3.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/drakkan/sftpgo | < 2.3.5 | 2.3.5 | GHSA-cf7g-cm7q-rq7f |
| Go | github.com/drakkan/sftpgo | all versions | — | GO-2022-1015 |
| Go | github.com/drakkan/sftpgo/v2 | < 2.3.5 | 2.3.5 | GO-2022-1015 |