CVE-2026-116844

MediumCVSS 4.8/10Last modified Oct 29, 2026

Description

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
fclairamb	ftpserverlib	<= 0.32.4
Syncplify, Inc.	Syncplify Server!	<= 8.8.0

References

Timeline

Published: Oct 27, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1168455.4NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to CVE-2026-1168465.3Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Contr CVE-2026-1168477.1Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.CVE-2026-1168486.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons f CVE-2026-1168496.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows CVE-2026-116854.3Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin CVE-2026-1168506.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happ CVE-2026-1168517.1Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.CVE-2026-1168529.1Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.CVE-2026-1168536.5Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.CVE-2026-1168546.5Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.CVE-2026-1168555.4Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured