CVE-2026-39983 - Vulnerability Analysis

Overview

basic-ftp < 5.2.1 contains a command injection caused by improper handling of CRLF sequences in file path parameters in high-level path APIs, letting attackers inject arbitrary FTP commands, exploit requires attacker-controlled path input.

Severity & Score

Impact

Attackers can inject and execute arbitrary FTP commands, potentially compromising the FTP session or server.

Mitigation

Update to version 5.2.1 or later.

References

• https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1
• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner