Vulnerability Description
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/client_handler.go#L720
- https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/handle_misc.go#L29-L31
- https://github.com/fclairamb/ftpserverlib/pull/685
- https://www.vulncheck.com/advisories/fclairamb-ftpserverlib-through-0.32.4-clear
FAQ
What is CVE-2026-116844?
CVE-2026-116844 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses T...
How severe is CVE-2026-116844?
CVE-2026-116844 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116844?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.