CVE-2015-10003: FileZilla Server PORT confused deputy

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-17 · updated 2026-06-17
Weakness: CWE-441

Description

A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.

Affected products

FileZilla Server: before 0.9.51 — fixed in 0.9.51

How to fix

Upgrade to a fixed version: FileZilla Server 0.9.51. Check the vendor advisory for mitigations.

References

http://www.securitygalore.com/site3/filezilla_ftp_server_advisory
https://vuldb.com/?id.97203
http://www.securitygalore.com/site3/filezilla_ftp_server_advisory
https://vuldb.com/?id.97203

Get alerted when CVE-2015-10003 or the next vulnerability affects your stack