CVE-2026-49245

Received Received - Intake

Stored XSS in SFTPGo via Inline Query Parameter

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim's browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-49245

Affected Vendors & Products

Vendor	Product	Version / Range
sftpgo	sftpgo	From 2.2.0 (inc) to 2.7.3 (inc)
sftpgo	sftpgo	2.7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SFTPGo versions 2.2.0 to 2.7.3 have a flaw where the inline query parameter on file downloads can suppress the Content-Disposition header, causing HTML files to be served as text/html instead of being downloaded. This allows an attacker to execute stored HTML files in a victim's browser if they access a crafted link.

Detection Guidance

Check SFTPGo version for affected range (2.2.0 to 2.7.2). Inspect web server logs for requests with inline query parameter on file downloads. Look for HTML files in shares or user directories that could be served as text/html.

Impact Analysis

An attacker could trick you into opening a malicious link, leading to execution of arbitrary HTML in your browser. This could result in session hijacking if cookies are not HttpOnly, data theft, or phishing attacks. Exploitation requires the attacker to have prior access to place a file in a share or home directory.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling cross-site scripting (XSS) attacks that may lead to unauthorized data access or manipulation. The stored HTML file execution in a victim's browser context could expose sensitive data or violate data integrity requirements under these regulations.

Mitigation Strategies

Upgrade SFTPGo to version 2.7.3 or later immediately. Remove or restrict write access to shares and home directories. Disable inline query parameter if not required. Monitor for suspicious file uploads.

Hi! I’m here to help you understand CVE-2026-49245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70