CVE-2026-116844
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS.
Does this matter?
Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.
Description
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
- CVSS 4.0
- 6.3 MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-319
- Source
- disclosure@vulncheck.com
References
- https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/client_handler.go#L720
- https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/handle_misc.go#L29-L31
- https://github.com/fclairamb/ftpserverlib/pull/685
- https://www.vulncheck.com/advisories/fclairamb-ftpserverlib-through-0.32.4-cleartext-ftpes-data-transfer-via-prot-p
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.