CVE-2026-49245— SFTPGo: Stored XSS via inline parameter on public shares and user file download
Quick assessment
Affected
drakkan sftpgo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SFTPGo 是一个开源、事件驱动的文件传输解决方案。在版本 2.2.0 至 2.7.3 之间，浏览共享文件下载和经过身份验证的用户文件下载中的内联查询参数会抑制 Content-Disposition: attachment 响应头。这使得攻击者可以将存储在共享目录或用户主目录中的 HTML 文件作为 text/html 类型，在 SFTPGo 的 Web 上下文中被提供。 攻击者若能将文件放置到相关目录中，即可向受害者发送一个精心构造的链接；受害者打开该链接后，存储的内容将在受害者浏览器的上下文中执行。该漏洞的
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49245
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SFTPGo: Stored XSS via inline parameter on public shares and user file download
Source: CVE Program / CVE List V5
Vulnerability Description
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim's browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49245
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49245
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-49245 (1)
Vendor Advisories for CVE-2026-49245 (1)
Vendor Pages for CVE-2026-49245 (1)
-
🔗 Release v2.7.3 · drakkan/sftpgo · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: sftpgo
-
CVE-2026-49244
SFTPGo: Path confinement bypass in public browsable share pa -
CVE-2026-10031
SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation -
CVE-2026-30915
SFTPGo improperly sanitizes placeholders in group home direc -
CVE-2026-30914
SFTPGo has a Path Traversal and Permission Bypass via Path N -
CVE-2025-24366
Insufficient sanitization of user provided rsync command in
Same vendor: drakkan
-
CVE-2026-49244
SFTPGo: Path confinement bypass in public browsable share pa -
CVE-2026-10031
SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation -
CVE-2026-30915
SFTPGo improperly sanitizes placeholders in group home direc -
CVE-2026-30914
SFTPGo has a Path Traversal and Permission Bypass via Path N -
CVE-2025-24366
Insufficient sanitization of user provided rsync command in
Same weakness: CWE-79
-
CVE-2026-32258
Winter: Stored XSS through Editor Settings custom styles -
CVE-2026-32257
Winter: Stored XSS through Brand Settings custom styles -
CVE-2026-80426
FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unesc -
CVE-2026-54606
SunEditor: DOM XSS in SunEditor Embed Plugin via External Sc -
CVE-2026-5092
Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored C
V. Comments for CVE-2026-49245
No comments yet