210 matches found
CVE-2025-71405 vulnerabilities
Vulnerabilities for packages: step-ca, kyverno-policy-reporter-ui-fips, dapr, step-issuer-fips, buf, gitness, karma, caddy-fips, tkn-fips, dapr-fips, tkn, cloudflared, caddy, step-ca-fips, step-fips, rclone, step, rclone-fips, kyverno-policy-reporter-ui, sftpgo, gogatekeeper, telegraf, step-issue...
GHSA-XCVF-46F4-XWXF vulnerabilities
Vulnerabilities for packages: step-ca, kyverno-policy-reporter-ui-fips, dapr, step-issuer-fips, buf, gitness, karma, caddy-fips, tkn-fips, dapr-fips, tkn, cloudflared, caddy, step-ca-fips, step-fips, rclone, step, rclone-fips, kyverno-policy-reporter-ui, sftpgo, gogatekeeper, telegraf, step-issue...
CVE-2025-71405 vulnerabilities
Vulnerabilities for packages: rclone, karma, step-ca, cloudflared, step, sftpgo, tkn, step-issuer, buf, caddy, kyverno-policy-reporter-ui, gitness, gogatekeeper...
GHSA-XCVF-46F4-XWXF vulnerabilities
Vulnerabilities for packages: rclone, karma, step-ca, cloudflared, step, sftpgo, tkn, step-issuer, buf, caddy, kyverno-policy-reporter-ui, gitness, gogatekeeper...
CVE-2026-49245
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...
CVE-2026-49244
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
EUVD-2026-63713
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
CVE-2026-49244
SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...
CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
CVE-2026-49245
SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 are affected by a stored XSS vulnerability. The inline query parameter on browsable-share and authenticated user-file download endpoints suppressed Content-Disposition: attachment, allowing an attacker-placed HTML file in a ...
CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...
EUVD-2026-63709
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...
CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...
CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...
CVE-2026-49244: Improper Limitation of a Pathname to a Restricted Directory
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
CVE-2026-49245: Improper Neutralization of Input During Web Page Generation
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...