CyberRota Analysis
AI-GeneratedSFTPGo versions 2.2.0 to 2.7.3 are vulnerable due to a flaw that allows an attacker to serve malicious HTML files as text/html, potentially leading to cross-site scripting (XSS) attacks when victims open crafted links. While exploitation requires social engineering and appropriate access to shared folders, the impact could compromise user sessions and data integrity. Organizations using affected versions should prioritize upgrading to version 2.7.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim's browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.