CVE-2026-102722

MediumCVSS 6.9

Published: 29/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

In the IPv4 PASV path, the FTP client accepts whatever address was sent in the server's `227` reply. Validation only covers parsing and non-zero values, so a malicious server can name any address and direct the client there.

Risk Assessment

A malicious FTP server can trick the client into connecting to an arbitrary address, enabling SSRF attacks or internal network scanning. This may lead to data leakage or unauthorized access to internal resources.

Recommendation

Update the FTP client to a version that validates the address returned in the 227 reply. Consider restricting the FTP client's outbound connections to trusted address ranges.

Other vulnerabilities in FTP Client

CVE-2026-109681Medium
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.

Original NVD description (English source)

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS