CVE-2011-4266

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-12-13 · updated 2026-06-16

Description

Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file, a different vulnerability than CVE-2011-3991.

Affected products

Ffftp: through 1.98; 1.79a, 1.80, 1.81, 1.82, 1.83, 1.84 (+32)

References

http://jvn.jp/en/jp/JVN94002296/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000104
http://sourceforge.jp/projects/ffftp/wiki/Security
http://jvn.jp/en/jp/JVN94002296/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000104
http://sourceforge.jp/projects/ffftp/wiki/Security

Get alerted when CVE-2011-4266 or the next vulnerability affects your stack