{"id":"EUVD-2026-63709","revision":"ee3c592933194902960915d60f954dec","records":[{"revision":"ee3c592933194902960915d60f954dec","observedAt":"2026-11-07T11:31:15.94+00:00","statement":{"source":"euvd","id":"EUVD-2026-63709","aliases":["CVE-2026-49245","GHSA-3vcg-pv95-pq54"],"title":"SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing a…","description":"SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim's browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","score":3.7,"severity":null}],"references":["https://github.com/drakkan/sftpgo/security/advisories/GHSA-3vcg-pv95-pq54","https://github.com/drakkan/sftpgo/commit/b5409a478138fca5f1d369ae5d47f753156cbd15","https://github.com/drakkan/sftpgo/releases/tag/v2.7.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63709","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 20, 2026, 9:52:20 PM","dateUpdated":"Aug 21, 2026, 3:35:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-63709","identifiers":["EUVD-2026-63709","CVE-2026-49245","GHSA-3vcg-pv95-pq54"]},"retained":false,"historicalAffected":[]}],"coverage":[]}