CVE-2026-109681

MediumCVSS 4.7

Published: 21/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.

Risk Assessment

An attacker can force the operator's machine to connect to arbitrary hosts, enabling internal network scanning or interaction with services not directly accessible. Organizations using FTP clients are exposed to SSRF and network reconnaissance risk.

Recommendation

Upgrade the FTP client to a version that validates PASV responses or restrict outbound connections to trusted hosts. Consider using safer protocols such as SFTP.

Other vulnerabilities in FTP client

CVE-2026-102722Medium
In the IPv4 PASV path, the FTP client accepts whatever address was sent in the server's `227` reply. Validation only covers parsing and non-zero values, so a malicious server can name any address and direct the client there.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS