CVE-2026-116844medium6.3
Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
The advisory, in context
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
Affected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
References
- https://github.com/fclairamb/ftpserverlib/pull/685
- https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/handle_misc.go#L29-L31
- https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/client_handler.go#L720
- https://www.vulncheck.com/advisories/fclairamb-ftpserverlib-through-0.32.4-cleartext-ftpes-data-transfer-via-prot-p