CVE-2026-116844: Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Fclairamb ftpserverlib through 0.32.4 are exposed when clients use FTPES data transfers and send PROT P after establishing a passive (PASV) or active (PORT) data connection. The issue can affect configurations that require encryption.
What does an attacker need to exploit it?
An attacker needs an on-path position able to observe or alter the FTP data connection. No FTP credentials or user interaction are required according to the supplied vector, but exploitation has high attack complexity.
What data and operations are affected?
File contents and directory listings transferred over the FTP data channel can be sent without encryption. An on-path attacker may read or modify that transferred data.
How can I tell whether a transfer is affected?
Affected behavior occurs when PROT P is issued after PASV or PORT and the prepared data connection does not use TLS. In that sequence, the server may treat the transfer as protected while sending the data channel in cleartext.