Vulnerability GO-2026-5900
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
July 07, 2026 at 03:26 PM UTC
SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo
v1.0.0 - v1.2.2
v1.0.0 - v1.2.2
Summary
SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo
Details
SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
SFTPGo source-side file-pattern filter bypass during copy operations
v2.5.0 - v2.7.5 GHSA-wwv9-g5x4-966q
v2.5.0 - v2.7.5 GHSA-wwv9-g5x4-966q
Medium Risk
6 hours ago
SFTPGo: Denial of service via malformed SSH channel request
v2.0.0 - v2.7.4 GHSA-q7pc-356p-hggc
v2.0.0 - v2.7.4 GHSA-q7pc-356p-hggc
Unknown
3 months ago
SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo
v2.2.0 - v2.7.2 GO-2026-5902
v2.2.0 - v2.7.2 GO-2026-5902
Unknown
3 months ago
SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo
v2.2.0 - v2.7.2 GO-2026-5902
v2.2.0 - v2.7.2 GO-2026-5902
Low Risk
3 months ago
SFTPGo has stored XSS via inline parameter on public shares and user file download
v2.2.0 - v2.7.2 GHSA-3vcg-pv95-pq54
v2.2.0 - v2.7.2 GHSA-3vcg-pv95-pq54
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 03:26 PM UTC
Fixed (v2.7.3)
4 months ago
May 30, 2026 at 07:45 PM UTC
Last Modified
3 months ago
July 07, 2026 at 04:00 PM UTC