CVE-2026-102722: SSRF
Published Sep 29, 2026
·Updated
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
Affected Software
1 affected component
Apache Commons Net
Event History
Sep 29, 2026
CVE Published
via MITRE·05:47 PM
Data Sourced
via MITRE·05:47 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is realistically exposed to this issue?
FTP client deployments using Apache Commons Net that connect to untrusted or malicious FTP servers through the IPv4 PASV path are exposed. The issue is triggered by a server-controlled 227 reply.
2
What does an attacker need to exploit it?
An attacker needs to operate or control an FTP server that the client connects to and provide a parsable 227 response containing non-zero address values. The client can then be directed to connect to an address selected by the server.