What’s Vulnerable › Vulnerabilities

CVE-2023-45688: Information leak via path traversal in Titan MFT and Titan SFTP servers

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17
• Weakness: CWE-22

Description

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command

Affected products

• Southrivertech Titan Mft Server: before 2.0.18 — fixed in 2.0.18
• Southrivertech Titan Sftp Server: before 2.0.18 — fixed in 2.0.18

How to fix

Upgrade to a fixed version: Southrivertech Titan Mft Server 2.0.18; Southrivertech Titan Sftp Server 2.0.18. Check the vendor advisory for mitigations.

References

• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Get alerted when CVE-2023-45688 or the next vulnerability affects your stack