An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674.

Summary

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.

Timeline

1. Mar 13, 2019Public exploit on Exploit-DB

   EDB-46535

2. Mar 22, 2019, 6:49 PM UTCCVE published
3. Aug 4, 2024, 9:54 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• CoreFtpNuGet

  through 2.0

References 6