The vulnerability in SFTPGo (CVE-2026-49245) involves a stored XSS caused by an inline query parameter that suppresses the Content-Disposition: attachment header on browsable-share file downloads and authenticated user file downloads. This allows HTML files stored in shares or home directories to be served as text/html and execute scripts in the SFTPGo web origin. Exploitation requires attacker-controlled file placement and victim interaction with a crafted URL, which is not generated by the WebClient, making social engineering necessary. HttpOnly cookies and session cookie overwrites limit the impact, confining realistic exploitation to public shares or shared folders between distinct users. The vulnerability is fixed in SFTPGo version 2.7.3 by removing the inline parameter and always responding with Content-Disposition: attachment.

The impact is low because exploitation requires specific conditions: attacker must place a malicious HTML file and trick a victim into opening a crafted link. The WebClient does not generate such links, so social engineering is necessary. HttpOnly session cookies prevent the injected script from stealing cookies, and authenticated shares overwrite session cookies, preventing account pivoting. The vulnerability represents a trust-boundary violation by serving attacker-controlled content as active HTML in the same origin, but practical exploitation scenarios are limited.

Upgrade SFTPGo to version 2.7.3 or later, where the inline query parameter has been removed and the endpoints always respond with Content-Disposition: attachment, preventing HTML files from being served as active content. This official fix fully mitigates the vulnerability.