CVE-2022-39220: medium-severity vulnerability in drakkan sftpgo
XSS Vulnerabilities in WebClient
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.6%
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
drakkan · sftpgoRelated CVEs — drakkan sftpgo
In the same product, most dangerous first.
CVE-2025-24366HIGHInsufficient sanitization of user provided rsync command in SFTPGoEPSS 0.7%CVE-2024-52309MEDIUMSFTPGo allows administrators to restrict command execution from the EventManagerEPSS 0.6%CVE-2026-30914MEDIUMSFTPGo has a Path Traversal and Permission Bypass via Path Normalization DiscrepancyEPSS 0.6%CVE-2022-36071HIGHRecovery codes abuse in SFTPGoEPSS 0.5%CVE-2026-49244MEDIUMSFTPGo: Path confinement bypass in public browsable share partial ZIP downloadEPSS 0.4%CVE-2024-52801MEDIUMBrute force takeover of OpenID Connect session cookies in sftpgoEPSS 0.4%