ftpserverlib CVE-2026-116844

The data connection must be prepared by PASV (passive) or PORT (active) while a cleartext protection level is in force, after which the client sends PROT P; ftpserverlib's TransferOpen then checks only the transferTLS flag set by PROT and not whether the already-prepared connection actually uses TLS, so the transfer proceeds unencrypted even with Settings.TLSRequired = MandatoryEncryption. Exploitation additionally requires the attacker to hold an on-path/man-in-the-middle position to observe or alter the cleartext data channel; it does not require authentication (PR:N) or user interaction, but the specific PROT-after-PASV/PORT ordering and the interception position are the real limiting factors (reflected in AC:H/AT:P). Impact is confined to the data channel (file contents and directory listings); control-channel credentials negotiated over the TLS control connection are not implicated.

This is a medium-severity information-disclosure/tampering flaw whose signals consistently point to low real-world urgency rather than an emergency. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3: network reachable and requiring no privileges or user interaction, but gated by high attack complexity (AC:H) and a specific attack requirement (AT:P) - consistent with the need for an on-path (man-in-the-middle) position plus the exact PROT-P-after-PASV/PORT command ordering. EPSS is 0.09% (0th percentile), there is no CISA KEV listing, and the CISA SSVC decision records Exploitation: none, Automatable: no, Technical Impact: partial, all of which agree the flaw is neither widely nor automatically exploitable. The vuln.today priority is 'this_month' (not act_now/emergency), so this should be scheduled rather than treated as a fire. The main caveat: the impact is understated by raw numbers if an environment relies on FTPES for confidentiality - on-path read/modify of file contents and listings defeats the mandatory-encryption guarantee the operator believes is in force. No signals conflict here; the low EPSS and SSVC 'none' are coherent with a flaw that requires both network interception and an unusual client command sequence.

An attacker positioned on the network path between an FTP client and a server built on ftpserverlib waits for a session where the client prepares its data channel with PASV or PORT and only then issues PROT P. Because the server opens the data connection in cleartext despite the requested protection, the attacker reads directory listings and file contents - or modifies them - in transit, even though the server is configured for mandatory encryption. A public PoC reference exists (a VulnCheck advisory and a regression test in the fix PR demonstrating the mismatch); it is not verified as working standalone exploit code.