CVE-2019-25683
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
FileZilla 3.40.0 has a denial of service vulnerability in the local search functionality. A local attacker can crash the application by supplying a malformed path string containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field.
Risk Assessment
An attacker can render the application unusable for the user, leading to loss of productivity and potential data loss.
Recommendation
Update FileZilla to the latest version that includes a fix for this vulnerability.
Original NVD description (English source)
FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation.