SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/drakkan/sftpgo(Go) | 0 | 2.3.5 | N/A |
CVSS Metrics
