CVE-2020-5221

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
troglobit	uftpd	< 2.11

References

https://github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fePatch, Third Party Advisory
https://github.com/troglobit/uftpd/security/advisories/GHSA-wmx8-v7mx-6x9hExploit, Third Party Advisory
https://github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fePatch, Third Party Advisory
https://github.com/troglobit/uftpd/security/advisories/GHSA-wmx8-v7mx-6x9hExploit, Third Party Advisory

Timeline

Published: Jan 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52228.8Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. CVE-2020-52234.4In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user pro CVE-2020-52248.8In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key CVE-2020-52255.4Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email t CVE-2020-52265.4Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to CVE-2020-52277.5Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content CVE-2020-52287.5Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the defau CVE-2020-52298.1Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes ar CVE-2020-52307.5Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for oper CVE-2020-52316.5In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the CVE-2020-52328.7A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without th CVE-2020-52336.1OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been