Executive brief
SFTPGo, a secure file transfer solution, is vulnerable to a security flaw where malicious files uploaded to the system could execute code in a user's browser. An attacker could use this to perform unauthorized actions if they trick a user into clicking a specially crafted link to a shared file. While the impact is limited by existing security measures like protected cookies, it could still lead to unauthorized data access within the file-sharing interface.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SFTPGo due to the 'inline' query parameter suppressing the 'Content-Disposition: attachment' header. This allows HTML files stored in a share or home directory to be served with a 'text/html' content type, executing within the SFTPGo web origin. Exploitation requires an attacker to upload a malicious file and use social engineering to convince a victim to visit a non-standard URL. The impact is mitigated by HttpOnly session cookies and the fact that authenticated shares use distinct session cookies, preventing easy account takeovers. The vulnerability is addressed in version 2.7.3 by removing the 'inline' parameter and enforcing download attachments.
Affected products
- drakkan SFTPGo >= 2.2.0, <= 2.7.1
Timeline
- 2026-05-30: disclosed
- 2026-07-02: advisory: GitHub Advisory published