Lucene search
+L

183 matches found

NVD
NVD
added 2026/08/20 10:17 p.m.8 views

CVE-2026-49245

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

3.7CVSS0.002EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/20 10:17 p.m.8 views

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

5.9CVSS0.0037EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/20 9:53 p.m.27 views

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

5.9CVSS0.0037EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 9:53 p.m.8 views

EUVD-2026-63713

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

5.9CVSS8.6AI score0.0037EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 9:53 p.m.4 views

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

5.9CVSS5.5AI score
SaveExploits0References5
CVE
CVE
added 2026/08/20 9:53 p.m.31 views

CVE-2026-49244

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...

5.9CVSS8.6AI score0.0037EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 9:52 p.m.4 views

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

3.7CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/20 9:52 p.m.25 views

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

3.7CVSS0.002EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 9:52 p.m.7 views

EUVD-2026-63709

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

3.7CVSS8.4AI score0.002EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/20 9:52 p.m.26 views

CVE-2026-49245

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 are affected by a stored XSS vulnerability. The inline query parameter on browsable-share and authenticated user-file download endpoints suppressed Content-Disposition: attachment, allowing an attacker-placed HTML file in a ...

3.7CVSS8.4AI score0.002EPSS
SaveExploits0References3
Chainguard
Chainguard
added 2026/08/14 8:25 a.m.19 views

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: traefik-fips, sftpgo, terraform-provider-acme-fips, traefik, terraform-provider-acme...

5.2AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/14 8:25 a.m.15 views

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: sftpgo, traefik-fips, traefik...

5.2AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/14 8:25 a.m.6 views

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea-fips, sftpgo, gitea...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/14 8:24 a.m.10 views

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: sftpgo, traefik...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/14 8:24 a.m.9 views

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: sftpgo, terraform-provider-acme, traefik...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/14 8:24 a.m.10 views

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea, sftpgo...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/14 8:23 a.m.8 views

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: karma, buf, rclone, sftpgo, step, tkn, kyverno-policy-reporter-ui, step-issuer, step-ca, gogatekeeper, caddy, cloudflared, gitness...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/14 8:23 a.m.11 views

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, policy-controller, cortex, kube-state-metrics, nri-kubernetes, lazydocker, spire-server, docker-machine-driver-harvester, net-kourier, temporal, opa-envoy, helm-push, cert-manager-webhook-pdns, descheduler,...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/14 8:23 a.m.11 views

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, aws-privateca-issuer, policy-controller, swagger, cortex, kubelet-csr-approver, juicefs, spire-server, kserve-modelmesh-serving, spire-controller-manager, crossplane-provider-sql, whereabouts, postgres-operator,...

5.2AI score
SaveExploits0
EUVD
EUVD
added 2026/07/31 12:30 a.m.15 views

EUVD-2026-51360

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

4.2CVSS5.9AI score0.00181EPSS
SaveExploits0References5
Rows per page
Query Builder