What’s Vulnerable › Vulnerabilities

CVE-2021-3331

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-27 · updated 2026-10-08

Description

WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)

Affected products

• Winscp: before 5.17.10 — fixed in 5.17.10

How to fix

Upgrade to a fixed version: Winscp 5.17.10. Check the vendor advisory for mitigations.

References

• https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d
• https://winscp.net/eng/docs/history#5.17.10
• https://winscp.net/eng/docs/rawsettings
• https://winscp.net/tracker/1943
• https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d
• https://winscp.net/eng/docs/history#5.17.10
• https://winscp.net/eng/docs/rawsettings
• https://winscp.net/tracker/1943

Get alerted when CVE-2021-3331 or the next vulnerability affects your stack