Loading story…
A command injection vulnerability in the Node.js FTP client library basic-ftp allows attacker-controlled file path input containing CRLF sequences to inject unintended FTP commands over the control connection. Tracked as CVE-2026-39983 and GHSA-CHQC-8P9Q-PQ6Q, the flaw stems from a design issue in the library's path handling: protectWhitespace() only accounts for leading spaces and does not block control characters, while FtpContext.send() appends \r\n and writes the resulting string directly to the FTP control socket.
The bug affects multiple high-level client methods that accept user-supplied paths, including cd(), remove(), list(), downloadTo(), uploadFrom(), rename(), and removeDir(). By embedding CRLF characters in a crafted path, an attacker can split one intended FTP request into multiple protocol commands or frames. The issue affects basic-ftp versions prior to 5.2.1, and the vendor has addressed it in version 5.2.1.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability affecting basic-ftp versions prior to 5.2.1 was fixed in version 5.2.1. The fix addressed FTP command injection through high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir().
A command injection flaw was identified in the Node.js FTP client library basic-ftp, where attacker-controlled path parameters containing CRLF sequences could inject additional FTP commands. The issue stemmed from protectWhitespace() not validating control characters before FtpContext.send() wrote commands to the FTP control socket.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two FTP server products were disclosed with serious buffer overflow vulnerabilities that can be triggered remotely. **Core FTP/SFTP Server 1.2** is affected by `CVE-2019-25654`, a flaw in the **User domain** field where an excessively long string of roughly 7,000 bytes can crash the application and cause a denial of service. The issue is classified as `CWE-120`/buffer overflow behavior with impact focused on availability, and public references include advisories from VulnCheck and Exploit-DB. A separate flaw, `CVE-2018-25254`, affects **NICO-FTP 3.0.1.19** and is described as a remote **SEH buffer overflow** reachable through crafted FTP commands containing oversized data. The vulnerability allows unauthenticated attackers to overwrite exception handler pointers and potentially execute injected shellcode, leading to full remote code execution with high impact on confidentiality, integrity, and availability. The disclosures highlight continued risk from legacy FTP software that processes untrusted input without proper bounds checking.
Jun 29, 2026
Researchers disclosed multiple serious vulnerabilities in **Monsta FTP**, including `CVE-2025-34299` for remote code execution and `CVE-2026-60105`, a high-severity unauthenticated server-side request forgery flaw affecting versions through **2.14.4**. The SSRF issue stems from incomplete IP blocklist validation in the `fetchRemoteFile` feature, allowing attackers to use IPv4-mapped IPv6 addresses such as `::ffff:169.254.169.254` to bypass protections meant to block loopback, private-network, and cloud metadata targets. The SSRF bug lets an unauthenticated attacker obtain a CSRF token, force the server to make HTTP or HTTPS GET requests, and exfiltrate responses to an attacker-controlled FTP server, potentially exposing cloud instance metadata, internal services, and loopback-only resources. VulnCheck said **Monsta FTP 2.14.5** silently fixed the SSRF issue without a security advisory, while separate reporting highlighted the remote code execution risk, leaving organizations using Monsta FTP facing both internal network exposure and possible full server compromise.
Jul 14, 2026
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026