SFTPGo WebClient vulnerable to Cross-site Scripting

MÉDIO 6.1CVE-2022-39220 · GHSA-cf7g-cm7q-rq7f · GO-2022-1015 · Published 20/09/2022 · updated 17/06/2026

Em resumo

CVE-2022-39220 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2, sftpgo (sftpgo project).
Chance de exploração nos próximos 30 dias (EPSS): 0.64%, maior que 50.5% das vulnerabilidades.
Correção: atualize para 2.3.5 ou posterior.

Package	Affected versions	Patched versions
github.com/drakkan/sftpgo Go	`< 2.3.5all versions`	`2.3.5`
github.com/drakkan/sftpgo/v2 Go	`< 2.3.5`	`2.3.5`
sftpgo sftpgo_project	`< 2.3.5`	`2.3.5`

Description

Impact

Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.

Patches

Fixed in v2.3.5.

NVD description

SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.

References

drakkan/sftpgo security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-39220 · ADVISORY
drakkan/sftpgo commit cbef217 · WEB
drakkan/sftpgo · PACKAGE

Mais vulnerabilidades de github.com/drakkan/sftpgo

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/drakkan/sftpgo

< 2.3.5all versions

2.3.5

github.com/drakkan/sftpgo/v2

< 2.3.5

2.3.5

sftpgo

sftpgo_project

< 2.3.5

2.3.5

Description

Impact

Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.

Patches

Fixed in v2.3.5.

NVD description

Mais vulnerabilidades de github.com/drakkan/sftpgo

Ver tudo →