Vsftpd
Monthly
FTPS data connections on vsftpd through 3.0.5 can be hijacked by a second client that resumes its own TLS session ticket against the victim's passive-mode data port, allowing theft of downloaded files or injection of content into uploads. The attacker must not be authenticated and must originate from the same source IP as the victim (shared NAT, VPN/proxy egress, or multi-tenant host) and win a timing race for the PASV connection, which is why the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with confidentiality and integrity impact but no availability impact. No confirmed working exploit code or CISA KEV entry is present in the available data, although the researcher's technical writeup is referenced, and vuln.today assigns an act_now decision label for any environment running FTPS on vsftpd ≤3.0.5.
Authenticated FTP users can bypass vsftpd’s cmds_denied command filter by sending RFC 775 X-prefixed aliases such as XRMD, XMKD, XCWD, XPWD, and XCUP, allowing operations the administrator intended to block, including directory deletion. The issue affects vsftpd through 3.0.5 and only matters when the server is explicitly configured with cmds_denied or an equivalent command restriction; default installations without such filtering have nothing to bypass. It is low severity with a CVSS 4.0 base score of 2.3 and integrity-only impact, no CISA KEV entry or public exploit code has been identified, and the vuln.today priority is monitor; the supplied vector indicates authenticated access (PR:L).
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.1%.
FTPS data connections on vsftpd through 3.0.5 can be hijacked by a second client that resumes its own TLS session ticket against the victim's passive-mode data port, allowing theft of downloaded files or injection of content into uploads. The attacker must not be authenticated and must originate from the same source IP as the victim (shared NAT, VPN/proxy egress, or multi-tenant host) and win a timing race for the PASV connection, which is why the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with confidentiality and integrity impact but no availability impact. No confirmed working exploit code or CISA KEV entry is present in the available data, although the researcher's technical writeup is referenced, and vuln.today assigns an act_now decision label for any environment running FTPS on vsftpd ≤3.0.5.
Authenticated FTP users can bypass vsftpd’s cmds_denied command filter by sending RFC 775 X-prefixed aliases such as XRMD, XMKD, XCWD, XPWD, and XCUP, allowing operations the administrator intended to block, including directory deletion. The issue affects vsftpd through 3.0.5 and only matters when the server is explicitly configured with cmds_denied or an equivalent command restriction; default installations without such filtering have nothing to bypass. It is low severity with a CVSS 4.0 base score of 2.3 and integrity-only impact, no CISA KEV entry or public exploit code has been identified, and the vuln.today priority is monitor; the supplied vector indicates authenticated access (PR:L).
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.1%.