{"id":"EUVD-2026-63709","enisaUuid":"0d41bbce-fa9a-3552-a39d-3e84454d2ee5","description":"SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim\u0027s browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.","datePublished":"Aug 20, 2026, 9:52:20 PM","dateUpdated":"Aug 21, 2026, 3:35:53 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-3vcg-pv95-pq54\nhttps://github.com/drakkan/sftpgo/commit/b5409a478138fca5f1d369ae5d47f753156cbd15\nhttps://github.com/drakkan/sftpgo/releases/tag/v2.7.3\n","aliases":"CVE-2026-49245\nGHSA-3vcg-pv95-pq54\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"3162f117-1c9c-3b0e-9bc1-de779599e83c","product":{"name":"sftpgo","vendor":{"name":"drakkan"}},"product_version":"2.2.0 \u003c 2.7.2"}],"enisaIdVendor":[{"id":"1a8c33f5-773b-32b4-93d6-3e47eb0fdc71","vendor":{"name":"drakkan"}}],"enisaIdVulnerability":[{"id":"c34738fe-4058-35c3-92bc-685736c60a30","vulnerability":{"id":"GHSA-3vcg-pv95-pq54","description":"SFTPGo has stored XSS via inline parameter on public shares and user file download","datePublished":"Jul 2, 2026, 7:09:30 PM","dateUpdated":"Jul 2, 2026, 7:09:30 PM","baseScore":0.0,"references":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-3vcg-pv95-pq54\nhttps://github.com/drakkan/sftpgo\n","enisa_id":"EUVD-2026-63709\n","aliases":"CVE-2026-49245\nGHSA-3vcg-pv95-pq54\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eefcff1e-b6f9-3f90-a1eb-b5f29750d238","vulnerability":{"id":"CVE-2026-49245","description":"SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim\u0027s browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.","datePublished":"Aug 20, 2026, 9:52:20 PM","dateUpdated":"Aug 21, 2026, 3:35:53 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-3vcg-pv95-pq54\nhttps://github.com/drakkan/sftpgo/commit/b5409a478138fca5f1d369ae5d47f753156cbd15\nhttps://github.com/drakkan/sftpgo/releases/tag/v2.7.3\n","enisa_id":"EUVD-2026-63709\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"1cf6a396-bf55-3668-96aa-4b0fff44a781","product":{"name":"sftpgo","vendor":{"name":"drakkan"}},"product_version":"2.2.0 \u003c 2.7.2"}],"vulnerabilityVendor":[{"id":"f95d9964-a5f6-38b2-bee0-d95d89ab3461","vendor":{"name":"drakkan"}}]}}],"enisaIdAdvisory":[]}