{"id":"CVE-2026-116844","kind":"vulnerability","aliases":["CVE-2026-116844"],"related":[],"title":"ftpserverlib: FTP transfers can run unencrypted despite mandatory TLS","description":"Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.","summary":"ftpserverlib through 0.32.4, a Go FTP server library, checks only the PROT flag when opening a data transfer, not whether the data connection actually uses TLS. A client that sends PROT P after PASV or PORT gets file contents and directory listings sent in cleartext, so an on-path attacker can read or modify them even where encryption is mandatory.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftp","go","package","self-hosted"],"not_affected_if":["no-ftpserverlib","sftp-only","trusted-network-only"],"how_to_check":"- Check whether the project depends on `github.com/fclairamb/ftpserverlib` and which version is in `go.mod` (`go list -m github.com/fclairamb/ftpserverlib`).\n- Look for a server that enforces TLS on data connections (mandatory encryption settings in the FTP server config).","fix":"- Upgrade `github.com/fclairamb/ftpserverlib` past `0.32.4` (fixed version not stated in the sources; check the upstream release notes).\n- Until patched, move file transfers to SFTP or FTPS-free alternatives, or restrict FTP to trusted networks.","status":"open","published_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:30+00:00","updated_at":"2026-10-27T01:36:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T01:36:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `github.com/fclairamb/ftpserverlib` past `0.32.4` (fixed version not stated in the sources; check the upstream release notes).\n- Until patched, move file transfers to SFTP or FTPS-free alternatives, or restrict FTP to trusted networks.","reach":"network","title":"ftpserverlib: FTP transfers can run unencrypted despite mandatory TLS","impact":"medium","summary":"ftpserverlib through 0.32.4, a Go FTP server library, checks only the PROT flag when opening a data transfer, not whether the data connection actually uses TLS. A client that sends PROT P after PASV or PORT gets file contents and directory listings sent in cleartext, so an on-path attacker can read or modify them even where encryption is mandatory.","category":"package","nicknames":[],"who_cares":["go","ftp","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"on-path attackers read or modify transferred files in transit","analyst_note":"Confirm the fixed version and whether a patch exists; the sources give only the affected range through 0.32.4 and an NVD link.","how_to_check":"- Check whether the project depends on `github.com/fclairamb/ftpserverlib` and which version is in `go.mod` (`go list -m github.com/fclairamb/ftpserverlib`).\n- Look for a server that enforces TLS on data connections (mandatory encryption settings in the FTP server config).","needs_analyst":true,"not_affected_if":["no-ftpserverlib","sftp-only","trusted-network-only"],"who_is_affected":"Applications that embed ftpserverlib as an FTP server and rely on mandatory TLS for data transfers are exposed, since the flaw bypasses that requirement when a client sends PROT P after PASV or PORT. Teams that only use FTP clients, or run no ftpserverlib-based server, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3362,"output_tokens":704,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116844':12A,15A '-2026':11A,14A '0.32.4':24B,86C 'actual':45B 'attack':72B,137C 'check':30B,94C 'cleartext':66B,89C 'client':49B,112C 'connect':44B,107C 'contain':87C 'content':60B,121C 'cross':125C 'cve':10A,13A 'data':38B,43B,106C 'despit':7A 'directori':62B,123C 'encrypt':80B,132C 'even':78B,129C 'fclairamb':83C 'file':59B,120C 'flag':34B,98C 'ftp':2A,16B,27B 'ftpserverlib':1A,22B,84C 'get':58B 'go':17B,26B 'host':21B 'let':133C 'librari':29B 'list':63B,124C 'mandatori':8A,82B,131C 'modifi':76B,140C 'network':127C 'on-path':69B,134C 'open':36B 'p':53B,115C 'packag':18B 'pasv':55B,117C 'path':71B,136C 'port':57B,119C 'prepar':105C 'prot':33B,52B,101C,114C 'read':74B,138C 'run':5A 'self':20B 'self-host':19B 'send':51B,113C 'sent':64B 'server':28B 'set':99C 'tls':9A,47B,109C 'transfer':3A,39B 'transferopen':93C 'transfertl':97C 'transmiss':90C 'unencrypt':6A,128C 'use':46B,108C 'vulner':91C 'whether':41B,103C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed ftpserverlib as an FTP server and rely on mandatory TLS for data transfers are exposed, since the flaw bypasses that requirement when a client sends PROT P after PASV or PORT. Teams that only use FTP clients, or run no ftpserverlib-based server, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116844","severity":null,"published_at":"2026-10-27T01:19:07+00:00","modified_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}