CVE-2026-49245

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

EUVD-2026-63713

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49244

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

EUVD-2026-63709

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 are affected by a stored XSS vulnerability. The inline query parameter on browsable-share and authenticated user-file download endpoints suppressed Content-Disposition: attachment, allowing an attacker-placed HTML file in a ...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: traefik, sftpgo, traefik-fips, terraform-provider-acme-fips, terraform-provider-acme...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: traefik, sftpgo, traefik-fips...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: sftpgo, gitea-fips, gitea...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme, sftpgo, traefik...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: sftpgo, traefik...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: sftpgo, gitea...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: cloudflared, step-ca, sftpgo, step-issuer, gitness, buf, gogatekeeper, rclone, step, karma, kyverno-policy-reporter-ui, caddy, tkn...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, kubernetes-event-exporter, jitsucom-bulker, spqr, flux-kustomize-controller, kubo, promxy, witness, dapr, fuse-overlayfs-snapshotter, goreleaser, octo-sts, snyk-cli, zarf, dask-gateway, k9s, kube-state-metrics,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, spqr, x509-certificate-exporter, docker-credential-gcr, flux-kustomize-controller, kubo, fuse-overlayfs-snapshotter, spire-controller-manager, goreleaser, octo-sts, gcp-compute-persistent-disk-csi-driver, go-licenses, dask-gateway,...

EUVD-2026-51360

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...