CVE-2026-49245 drakkan CVE debrief

Who should care

Administrators and users of SFTPGo versions 2.2.0 to 2.7.3 should review and apply patches to prevent potential exploitation. This includes reviewing share and folder access controls, monitoring for suspicious file downloads and user activity, and implementing additional security controls such as validating user input and restricting file types. Security teams should prioritize patching and verify the integrity of their SFTPGo deployments, especially in environments with sensitive data or high-risk exposure. Vulnerability management and security operations teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators of SFTPGo instances should also consider compensating controls for exposed systems while remediation is scheduled and verified, and ensure that HttpOnly session cookies are properly configured to limit direct cookie theft. Platform owners and security teams should coordinate on verifying affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. This may involve reviewing relevant monitoring, detection, and logs for exposed assets that need extra review, and assigning an owner for follow-up on affected product deployments in managed environments. The vulnerability management process should include tracking of affected product or component, vulnerability class, likely operational impact, source-confidence limits, and review context to prioritize and expedite remediation efforts. Security teams should also consider implementing additional security controls such as validating user input and restricting file types to prevent similar vulnerabilities in the future. SFTPGo users should also review compensating controls for exposed systems while remediation is scheduled and verified, and ensure that security operations teams are aware of the potential risks and are monitoring for suspicious activity. Security teams should also review and apply patches for SFTPGo versions 2.2.0 to 2.7.3, and consider implementing additional security controls such as asset inventory and source tracking to prevent similar -

Technical summary

The SFTPGo inline query parameter vulnerability allows an attacker to serve attacker-controlled HTML files as text/html, potentially leading to execution of malicious content in a victim's browser context. This requires social engineering and suitable share or shared-folder access. The vulnerability is fixed in SFTPGo version 2.7.3. Administrators should review and apply patches to prevent potential exploitation.

Defensive priority

Low-priority defensive review recommended due to limited attack surface.

Recommended defensive actions

• Review and apply vendor patches for SFTPGo versions 2.2.0 to 2.7.3.
• Restrict access to sensitive shares and folders.
• Monitor for suspicious file downloads and user activity.
• Implement additional security controls, such as validating user input and restricting file types.
• Verify share and folder access controls.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence is limited; verify affected SFTPGo versions (2.2.0 to 2.7.3) and patch applicability. The SFTPGo inline query parameter vulnerability allows attacker-controlled HTML files to be served as text/html. Exploitation requires social engineering and suitable share or shared-folder access. Defenders should verify share and folder access controls, monitor for suspicious file downloads and user activity, and implement additional security controls such as validating user input and restricting file types.

Official resources