CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2022-39220
Medium (6.1) in sftpgo project sftpgo. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/drakkan/sftpgo 2.3.5.
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sftpgo_project:sftpgo
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cf7g-cm7q-rq7f | Go | github.com/drakkan/sftpgo | <2.3.5 | 2.3.5 |
| GO-2022-1015 | Go | github.com/drakkan/sftpgo | all versions | no fix published |
| GO-2022-1015 | Go | github.com/drakkan/sftpgo/v2 | <2.3.5 | 2.3.5 |