CVE-2026-8328: FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
Other sources
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-12 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 8.0.0+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u3 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.10-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2021-4189 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-8328 - Configuration
Ensure ftpcp() does not pass the raw attacker-controllable PASV IP/port returned via parse227() directly to target.sendport(); modify ftpcp() so the PASV host is derived from the actual peer address (getpeername()[0]), consistent with the makepasv() fix for CVE-2021-4189.
CPython ftplib.py (ftpcp/parse227/makepasv) PASV host address source = Use actual peer address getpeername()[0] instead of server-supplied PASV host address
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8328?
CVE-2026-8328 is considered a high severity vulnerability due to its potential for exploitation through SSRF attacks.
How do I fix CVE-2026-8328?
To fix CVE-2026-8328, update to the latest version of Python CPython ftplib where the vulnerability has been addressed.
Which versions of Python CPython ftplib are affected by CVE-2026-8328?
CVE-2026-8328 affects specific versions of Python CPython ftplib prior to the security patches that address this issue.
What type of attack does CVE-2026-8328 facilitate?
CVE-2026-8328 facilitates Server-Side Request Forgery (SSRF) attacks by trusting server-supplied PASV host addresses.
Is CVE-2026-8328 related to previous vulnerabilities?
Yes, CVE-2026-8328 is related to CVE-2021-4189, which involved similar trust issues with PASV addresses.