What’s Vulnerable › Vulnerabilities

CVE-2020-36617: ewxrjk sftpserver parse.c sftp_parse_path uninitialized pointer

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-18 · updated 2026-06-17
• Weakness: CWE-908

Description

A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models.

Affected products

• ewxrjk sftpserver: before 2 — fixed in 2

How to fix

Upgrade to a fixed version: ewxrjk sftpserver 2. Check the vendor advisory for mitigations.

References

• https://github.com/ewxrjk/sftpserver/commit/bf4032f34832ee11d79aa60a226cc018e7ec5eed
• https://vuldb.com/?id.216205
• https://github.com/ewxrjk/sftpserver/commit/bf4032f34832ee11d79aa60a226cc018e7ec5eed
• https://vuldb.com/?id.216205

Get alerted when CVE-2020-36617 or the next vulnerability affects your stack