V2: SFTPGo has stored XSS via inline parameter on public shares and user file download (CVE-2026-49245)
## Summary The inline query parameter on the browsable-share file download and on the authenticated user file download suppressed Content-Disposition: attachment, so an HTML file stored in a share or home directory could be served as text/html and execute in SFTPGo's web origin (stored XSS). ## Impact Low. Exploitation requires the attacker to place the file and a victim to open the crafted link — a URL the WebClient never generates, so it requires social engineering — and the practical conditions are narrow: - Session cookies are HttpOnly, so the cookie cannot be read by the injected script. - Authenticated shares set their own session cookie, which overwrites the victim's WebClient cookie, no account pivot. The realistic case is a public share, or a folder shared between distinct users combined with targeted social engineering. It is a genuine trust-boundary violation (SFTPGo emits attacker-controlled content as active HTML in its own origin), hence an advisory, but the constrained preconditions and the HttpOnly mitigation keep it Low. ## Patches Upgrade to v2.7.3. These endpoints now always respond with Content-Disposition: attachment; the inline parameter has been removed. See the fix commit for the full technical rationale.
AI Analysis
Technical Summary
The vulnerability in SFTPGo (CVE-2026-49245) involves a stored XSS caused by an inline query parameter that suppresses the Content-Disposition: attachment header on browsable-share file downloads and authenticated user file downloads. This allows HTML files stored in shares or home directories to be served as text/html and execute scripts in the SFTPGo web origin. Exploitation requires attacker-controlled file placement and victim interaction with a crafted URL, which is not generated by the WebClient, making social engineering necessary. HttpOnly cookies and session cookie overwrites limit the impact, confining realistic exploitation to public shares or shared folders between distinct users. The vulnerability is fixed in SFTPGo version 2.7.3 by removing the inline parameter and always responding with Content-Disposition: attachment.
Potential Impact
The impact is low because exploitation requires specific conditions: attacker must place a malicious HTML file and trick a victim into opening a crafted link. The WebClient does not generate such links, so social engineering is necessary. HttpOnly session cookies prevent the injected script from stealing cookies, and authenticated shares overwrite session cookies, preventing account pivoting. The vulnerability represents a trust-boundary violation by serving attacker-controlled content as active HTML in the same origin, but practical exploitation scenarios are limited.
Mitigation Recommendations
Upgrade SFTPGo to version 2.7.3 or later, where the inline query parameter has been removed and the endpoints always respond with Content-Disposition: attachment, preventing HTML files from being served as active content. This official fix fully mitigates the vulnerability.
V2: SFTPGo has stored XSS via inline parameter on public shares and user file download (CVE-2026-49245)
Description
## Summary The inline query parameter on the browsable-share file download and on the authenticated user file download suppressed Content-Disposition: attachment, so an HTML file stored in a share or home directory could be served as text/html and execute in SFTPGo's web origin (stored XSS). ## Impact Low. Exploitation requires the attacker to place the file and a victim to open the crafted link — a URL the WebClient never generates, so it requires social engineering — and the practical conditions are narrow: - Session cookies are HttpOnly, so the cookie cannot be read by the injected script. - Authenticated shares set their own session cookie, which overwrites the victim's WebClient cookie, no account pivot. The realistic case is a public share, or a folder shared between distinct users combined with targeted social engineering. It is a genuine trust-boundary violation (SFTPGo emits attacker-controlled content as active HTML in its own origin), hence an advisory, but the constrained preconditions and the HttpOnly mitigation keep it Low. ## Patches Upgrade to v2.7.3. These endpoints now always respond with Content-Disposition: attachment; the inline parameter has been removed. See the fix commit for the full technical rationale.
CVSS v3.1
Score 3.7low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in SFTPGo (CVE-2026-49245) involves a stored XSS caused by an inline query parameter that suppresses the Content-Disposition: attachment header on browsable-share file downloads and authenticated user file downloads. This allows HTML files stored in shares or home directories to be served as text/html and execute scripts in the SFTPGo web origin. Exploitation requires attacker-controlled file placement and victim interaction with a crafted URL, which is not generated by the WebClient, making social engineering necessary. HttpOnly cookies and session cookie overwrites limit the impact, confining realistic exploitation to public shares or shared folders between distinct users. The vulnerability is fixed in SFTPGo version 2.7.3 by removing the inline parameter and always responding with Content-Disposition: attachment.
Potential Impact
The impact is low because exploitation requires specific conditions: attacker must place a malicious HTML file and trick a victim into opening a crafted link. The WebClient does not generate such links, so social engineering is necessary. HttpOnly session cookies prevent the injected script from stealing cookies, and authenticated shares overwrite session cookies, preventing account pivoting. The vulnerability represents a trust-boundary violation by serving attacker-controlled content as active HTML in the same origin, but practical exploitation scenarios are limited.
Mitigation Recommendations
Upgrade SFTPGo to version 2.7.3 or later, where the inline query parameter has been removed and the endpoints always respond with Content-Disposition: attachment, preventing HTML files from being served as active content. This official fix fully mitigates the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3vcg-pv95-pq54
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49245"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a46ecbb27e9c7971943cde5
Added to database: 07/02/2026, 22:56:59 UTC
Last enriched: 07/02/2026, 23:14:10 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.