Lftp

This hub aggregates every CVE we track for Lftp, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 4 most recently published vulnerabilities affecting Lftp.

• CVE-2018-10916It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A...5.3Aug 1, 2018
• CVE-2010-2251The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote serve...7.5Jul 6, 2010
• CVE-2007-2348mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is no...6.8Apr 27, 2007
• CVE-2003-0963Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the l...7.5Dec 17, 2003