CVE-2026-49245

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

EUVD-2026-63713

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

EUVD-2026-63709

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: sftpgo, terraform-provider-acme-fips, traefik, traefik-fips, terraform-provider-acme...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: traefik, sftpgo, traefik-fips...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea-fips, sftpgo, gitea...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: sftpgo, traefik...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: sftpgo, terraform-provider-acme, traefik...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea, sftpgo...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: gitness, step-ca, tkn, caddy, cloudflared, karma, rclone, step, gogatekeeper, sftpgo, buf, kyverno-policy-reporter-ui, step-issuer...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: hubble, libnvidia-container, vault-k8s, nova, kubernetes, litestream, crossplane, prometheus-adapter, steampipe, rancher, victoriametrics-cluster, newrelic-nri-kube-events, helm-push, sftpgo-plugin-pubsub, guac, sigstore-scaffolding, trino, aws-efs-csi-driver,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: hubble, pvc-autoresizer, cert-manager-cmctl, kustomize, tfsec, vault-k8s, litestream, steampipe, falcosidekick, metacontroller, dkron, sftpgo-plugin-pubsub, aws-eks-pod-identity-agent, yunikorn-k8shim, guac, docker-credential-ecr-login, ytt, minio-object-browser, kub...

EUVD-2026-51360

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...