Live › vulnerability › CVE-2026-116844
Go to dashboardftpserverlib through 0.32.4, a Go FTP server library, checks only the PROT flag when opening a data transfer, not whether the data connection actually uses TLS. A client that sends PROT P after PASV or PORT gets file contents and directory listings sent in cleartext, so an on-path attacker can read or modify them even where encryption is mandatory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 01:34 UTC. All times on this page are UTC.
Applications that embed ftpserverlib as an FTP server and rely on mandatory TLS for data transfers are exposed, since the flaw bypasses that requirement when a client sends PROT P after PASV or PORT. Teams that only use FTP clients, or run no ftpserverlib-based server, can skip it.
No product ranges from the sources yet.
github.com/fclairamb/ftpserverlib and which version is in go.mod (go list -m github.com/fclairamb/ftpserverlib).github.com/fclairamb/ftpserverlib past 0.32.4 (fixed version not stated in the sources; check the upstream release notes).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
This page as .md · .json · in your agent: get_signal("CVE-2026-116844")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.