{"id":"GO-2026-5900","revision":"c4591d0ea1a04494b671b6bc3c95093f","records":[{"revision":"c4591d0ea1a04494b671b6bc3c95093f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5900","aliases":["CVE-2026-49245","GHSA-3vcg-pv95-pq54"],"title":"SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo","description":"SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo","state":0,"publishedAt":"2026-07-07T15:26:37+00:00","modifiedAt":"2026-07-07T16:00:24.1630697+00:00","affected":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.2.0"},{"kind":"fixed","version":"2.7.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/drakkan/sftpgo/security/advisories/GHSA-3vcg-pv95-pq54"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5900","license":"OSV · upstream source license applies","key":"osv:GO-2026-5900","identifiers":["GO-2026-5900","CVE-2026-49245","GHSA-3vcg-pv95-pq54"]},"retained":false,"historicalAffected":[]}],"coverage":[]}