SFTPGo enables a download URL that contains an inline query parameter. When this parameter is used, the server suppresses the Content‑Disposition header, causing the browser to interpret the requested file as text/html. An attacker who can place an arbitrary HTML file in a shared or user home directory can craft a link that includes the inline parameter so that the file is served as an HTML page. Opening that link triggers the browser to execute the malicious script in the victim’s context, delivering a classic stored XSS attack.

The vulnerability affects drakkan’s SFTPGo versions 2.2.0 through 2.7.2 inclusive. Upgrading to version 2.7.3 or later eliminates the inline parameter handling that suppresses the Content‑Disposition header and removes the flaw.

The CVSS score of 3.7 indicates low overall severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to have the ability to upload a file to a share or shared‑folder location and then persuade or trick a victim into visiting a specially crafted URL that includes the inline query parameter. Because the vulnerability is client‑side only and HttpOnly session cookies are in place, direct server‑side compromise or cookie theft is not possible, but the injected script runs with the victim’s browser privileges. The overall risk to an organization is moderate and mitigated through the rapid application of the vendor’s patch.