Loading story…
Two FTP server products were disclosed with serious buffer overflow vulnerabilities that can be triggered remotely. Core FTP/SFTP Server 1.2 is affected by CVE-2019-25654, a flaw in the User domain field where an excessively long string of roughly 7,000 bytes can crash the application and cause a denial of service. The issue is classified as CWE-120/buffer overflow behavior with impact focused on availability, and public references include advisories from VulnCheck and Exploit-DB.
A separate flaw, CVE-2018-25254, affects NICO-FTP 3.0.1.19 and is described as a remote SEH buffer overflow reachable through crafted FTP commands containing oversized data. The vulnerability allows unauthenticated attackers to overwrite exception handler pointers and potentially execute injected shellcode, leading to full remote code execution with high impact on confidentiality, integrity, and availability. The disclosures highlight continued risk from legacy FTP software that processes untrusted input without proper bounds checking.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry documented a remotely exploitable SEH buffer overflow in NICO-FTP 3.0.1.19, where crafted oversized FTP command data can let an unauthenticated attacker overwrite SEH pointers and achieve arbitrary code execution. The record was received by disclosure@vulncheck.com and includes references to advisory and exploit sources.
A CVE record was received documenting a buffer overflow in Core FTP/SFTP Server 1.2 that can be triggered with an excessively long User domain string, causing the application to crash and resulting in denial of service. The record notes receipt by disclosure@vulncheck.com and references supporting advisories and exploit material.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple serious vulnerabilities in **Monsta FTP**, including `CVE-2025-34299` for remote code execution and `CVE-2026-60105`, a high-severity unauthenticated server-side request forgery flaw affecting versions through **2.14.4**. The SSRF issue stems from incomplete IP blocklist validation in the `fetchRemoteFile` feature, allowing attackers to use IPv4-mapped IPv6 addresses such as `::ffff:169.254.169.254` to bypass protections meant to block loopback, private-network, and cloud metadata targets. The SSRF bug lets an unauthenticated attacker obtain a CSRF token, force the server to make HTTP or HTTPS GET requests, and exfiltrate responses to an attacker-controlled FTP server, potentially exposing cloud instance metadata, internal services, and loopback-only resources. VulnCheck said **Monsta FTP 2.14.5** silently fixed the SSRF issue without a security advisory, while separate reporting highlighted the remote code execution risk, leaving organizations using Monsta FTP facing both internal network exposure and possible full server compromise.
Jul 14, 2026
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026
A command injection vulnerability in the Node.js FTP client library **basic-ftp** allows attacker-controlled file path input containing `CRLF` sequences to inject unintended FTP commands over the control connection. Tracked as **CVE-2026-39983** and **GHSA-CHQC-8P9Q-PQ6Q**, the flaw stems from a design issue in the library's path handling: `protectWhitespace()` only accounts for leading spaces and does not block control characters, while `FtpContext.send()` appends `\r\n` and writes the resulting string directly to the FTP control socket. The bug affects multiple high-level client methods that accept user-supplied paths, including `cd()`, `remove()`, `list()`, `downloadTo()`, `uploadFrom()`, `rename()`, and `removeDir()`. By embedding `CRLF` characters in a crafted path, an attacker can split one intended FTP request into multiple protocol commands or frames. The issue affects **basic-ftp** versions prior to **5.2.1**, and the vendor has addressed it in version **5.2.1**.
Jun 29, 2026