CVE-2026-116844 in Ftpserverlib
Summary
by MITRE • 10/27/2026
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Fclairamb ftpserverlib versions through 0.32.4 represents a critical failure in enforcing secure data channel protocols within an FTP server implementation. The core technical flaw lies in the logic governing the transition from command channels to data channels, specifically during the execution of the TransferOpen function. In standard File Transfer Protocol operations, clients and servers negotiate encryption levels using the PROT command, such as setting it to P for private or clear text transmission. However, this library incorrectly assumes that if a client explicitly requests plaintext via PROT P after issuing passive PASV or active PORT commands, the resulting data connection is safe to open without further verification. The implementation fails to verify whether the underlying socket connection has actually been wrapped in Transport Layer Security before allowing file transfers or directory listings to proceed. This logical gap means that even if the server configuration mandates encryption for all operations, a malicious client can bypass these requirements by simply sending PROT P after establishing the control channel and requesting data transfer parameters.
This misconfiguration leads directly to cleartext transmission of sensitive information over unencrypted network connections. When an attacker exploits this flaw, they can intercept file contents, directory listings, and potentially authentication credentials if transmitted during the session without encryption. The operational impact is severe for organizations relying on this library for secure file transfers, as it undermines the fundamental security guarantees provided by FTPS. On-path attackers positioned between the client and server can perform passive eavesdropping to harvest confidential data or engage in active man-in-the-middle attacks to modify files during transit. This vulnerability effectively nullifies any compliance efforts related to data protection standards that require encryption of sensitive data in transit, such as PCI DSS requirements for financial data or HIPAA mandates for healthcare information.
From a classification perspective, this issue aligns with CWE-319, which describes cleartext transmission of sensitive information over an exposed channel. It also relates closely to CWE-648 regarding the misuse of special elements that circumvent security mechanisms, as the client exploits the server's trust in its own protocol flags without verifying actual cryptographic state. In terms of adversary tactics, this vulnerability facilitates reconnaissance and data exfiltration phases within the MITRE ATT&CK framework, allowing attackers to gather intelligence or steal assets with minimal effort due to the lack of encryption enforcement at the application layer. The flaw highlights a common pitfall in network protocol implementations where logical checks are not sufficiently decoupled from state verification, leading to assumptions that do not hold under adversarial conditions.
To mitigate this vulnerability, developers must update Fclairamb ftpserverlib to version 0.32.5 or later, which addresses the logic error by ensuring that data connections are verified for TLS encryption regardless of the PROT flag sent by the client. For systems unable to upgrade immediately, administrators should enforce strict firewall rules that restrict FTPS traffic to known trusted clients and monitor network logs for anomalies indicative of cleartext FTP sessions. Additionally, implementing deep packet inspection can help detect attempts to downgrade security protocols or exploit this specific logic flaw. It is crucial to audit all instances where the library handles data connections to ensure that encryption status is validated against actual socket properties rather than relying solely on client-provided protocol commands. Regular penetration testing focused on protocol state machines and edge cases in authentication flows will further help identify similar logical vulnerabilities before they can be exploited in production environments.