CVE-2018-10916

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
[UNKNOWN]	lftp	up to and including 4.8.3

References

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916Issue Tracking, Patch, Third Party Advisory
https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992Patch, Third Party Advisory
https://github.com/lavv17/lftp/issues/452Exploit, Third Party Advisory
https://usn.ubuntu.com/3731-2/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916Issue Tracking, Patch, Third Party Advisory
https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992Patch, Third Party Advisory
https://github.com/lavv17/lftp/issues/452Exploit, Third Party Advisory
https://usn.ubuntu.com/3731-2/Third Party Advisory

Timeline

Published: Aug 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-109176.5pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to l CVE-2018-109186.5A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker c CVE-2018-109196.5The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authent CVE-2018-10925.5The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_co CVE-2018-109206.8Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.CVE-2018-109217.5Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially lead to corruption of CVE-2018-109225.5An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of service condition due CVE-2018-109238.1It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated a CVE-2018-109246.5It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a CVE-2018-109258.1It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain CVE-2018-109268.8A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write f CVE-2018-109278.1A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information