CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49244: Improper Limitation of a Pathname to a Restricted Directory

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49245: Improper Neutralization of Input During Web Page Generation

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips, sftpgo...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, traefik, sftpgo, terraform-provider-acme, traefik-fips...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea-fips, gitea, sftpgo...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: traefik, sftpgo...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme, traefik, sftpgo...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea, sftpgo...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: rclone, cloudflared, step, step-ca, buf, tkn, caddy, karma, gitness, step-issuer, kyverno-policy-reporter-ui, sftpgo, gogatekeeper...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nova, newrelic-nri-statsd, envconsul, timoni, neuvector-dbgen, nri-mssql, hcloud, external-secrets-operator, dynamic-localpv-provisioner, harbor, rancher-webhook, gostatsd, temporal-server, crossplane-provider-family-azure, vault-benchmark, multus-cni,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, nri-f5, verticadb-operator, kubernetes-dashboard-metrics-scraper, terraform, newrelic-nri-statsd, boring-registry, yunikorn-k8shim, kuberlr, timoni, ferretdb, dynamic-localpv-provisioner, gitness, whereabouts, gostatsd, kubernetes-dashboard-api...

EUVD-2026-51360

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...

CVE-2026-10031: Incorrect Authorization

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

GO-2026-5900 SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo

SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo...