CVE-2022-39220: 
NixOS vulnerability analysis and mitigation

SFTPGo, an SFTP server written in Go, was found to contain Cross-site scripting (XSS) vulnerabilities in its WebClient component. The vulnerability, identified as CVE-2022-39220, affects versions prior to 2.3.5 and was disclosed on September 2, 2022. The vulnerability allows remote attackers to inject malicious code through the WebClient interface (GitHub Advisory, NVD).

The vulnerability is classified as a Cross-site scripting (XSS) issue affecting the SFTPGo WebClient interface. The security flaw enables remote attackers to inject and execute malicious code through the web interface. The vulnerability has been assigned a moderate severity rating (GitHub Advisory).

When successfully exploited, this vulnerability allows remote attackers to inject and execute malicious code through the SFTPGo WebClient interface, potentially compromising user sessions and accessing sensitive information (GitHub Advisory).

The vulnerability has been patched in SFTPGo version 2.3.5. Users are advised to upgrade to this version or later as no known workarounds exist for affected versions (GitHub Advisory).