SFTPGo WebClient vulnerable to Cross-site Scripting

MEDIO 6.1CVE-2022-39220 · GHSA-cf7g-cm7q-rq7f · GO-2022-1015 · Published 20/09/2022 · updated 17/06/2026

In breve

CVE-2022-39220 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2, sftpgo (sftpgo project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.64%, superiore al 50.5% delle vulnerabilità.
Correzione: aggiornare a 2.3.5 o successiva.

Package	Affected versions	Patched versions
github.com/drakkan/sftpgo Go	`< 2.3.5all versions`	`2.3.5`
github.com/drakkan/sftpgo/v2 Go	`< 2.3.5`	`2.3.5`
sftpgo sftpgo_project	`< 2.3.5`	`2.3.5`

Description

Impact

Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.

Patches

Fixed in v2.3.5.

NVD description

SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.

References

drakkan/sftpgo security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-39220 · ADVISORY
drakkan/sftpgo commit cbef217 · WEB
drakkan/sftpgo · PACKAGE

Altre vulnerabilità di github.com/drakkan/sftpgo

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/drakkan/sftpgo

< 2.3.5all versions

2.3.5

github.com/drakkan/sftpgo/v2

< 2.3.5

2.3.5

sftpgo

sftpgo_project

< 2.3.5

2.3.5

Description

Impact

Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.

Patches

Fixed in v2.3.5.

NVD description

Altre vulnerabilità di github.com/drakkan/sftpgo

Vedi tutto →