{"apiVersion":"1.0","identifier":"CVE-2026-49245","description":"SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home directory to be served as text/html in the SFTPGo web origin. An attacker who can place the file can send a crafted link to a victim, and opening that link executes the stored content in the victim-s browser context. Exploitation requires social engineering and suitable share or shared-folder access, while HttpOnly session cookies limit direct cookie theft. This issue is fixed in version 2.7.3.","publishedAt":"2026-08-20T22:17:20","lastModifiedAt":"2026-08-21T16:17:18","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49245","cvssScore":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","epssProbability":0.002,"riskScore":0.38,"affectedProduct":"SFTPGo","affectedVersions":">=2.2.0,<2.7.3","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-49245","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-49245","en":"https://www.redsauce.net/en/cves/CVE-2026-49245","fr":"https://www.redsauce.net/fr/cves/CVE-2026-49245","pt":"https://www.redsauce.net/pt/cves/CVE-2026-49245","de":"https://www.redsauce.net/de/cves/CVE-2026-49245","sk":"https://www.redsauce.net/sk/cves/CVE-2026-49245","el":"https://www.redsauce.net/el/cves/CVE-2026-49245"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-49245"}}