CVE-2018-10916

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-08-01 · updated 2026-06-17
Weakness: CWE-20

Description

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.

Affected products

Canonical Ubuntu Linux: 12.04
Lftp Project Lftp: through 4.8.3
openSUSE Leap: 42.3

References

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916
https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992
https://github.com/lavv17/lftp/issues/452
https://usn.ubuntu.com/3731-2/
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916
https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992
https://github.com/lavv17/lftp/issues/452
https://usn.ubuntu.com/3731-2/

Get alerted when CVE-2018-10916 or the next vulnerability affects your stack