CoreFTP Directory Traversal

MEDIUM 5.3CVE-2019-9648 · GHSA-w393-h95m-f879 · Published 22/03/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
CoreFtp NuGet	`≤ 2.0`	No fix yet
core ftp coreftp	`= 2.0`	No fix yet

Description

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.

NVD description

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.

References

nvd.nist.gov/vuln/detail/CVE-2019-9648 · ADVISORY
sparkeh9/CoreFTP · PACKAGE
seclists.org/fulldisclosure/2019/Mar/23 · WEB
web.archive.org/web/20210125013812/https://www.securityfocus.com/bid/107446 · WEB
exploit-db.com/exploits/46535 · WEB
packetstormsecurity.com/files/154204/CoreFTP-Server-SIZE-Directory-Traversal.html · WEB
seclists.org/fulldisclosure/2019/Aug/21 · WEB
coreftp.com/forums/viewtopic.php · WEB
securityfocus.com/bid/107446 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free