What’s Vulnerable › Vulnerabilities

CVE-2023-45685: Arbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17
• Weakness: CWE-22

Description

Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal

Affected products

• Southrivertech Titan Mft Server: before 2.0.18 — fixed in 2.0.18
• Southrivertech Titan Sftp Server: before 2.0.18 — fixed in 2.0.18

How to fix

Upgrade to a fixed version: Southrivertech Titan Mft Server 2.0.18; Southrivertech Titan Sftp Server 2.0.18. Check the vendor advisory for mitigations.

References

• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Get alerted when CVE-2023-45685 or the next vulnerability affects your stack