What’s Vulnerable › Vulnerabilities

CVE-2023-45689: Arbitrary file read via path traversal in Titan MFT and Titan SFTP servers

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17
• Weakness: CWE-22

Description

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal

Affected products

• Southrivertech Titan Mft Server: before 2.0.18 — fixed in 2.0.18
• Southrivertech Titan Sftp Server: before 2.0.18 — fixed in 2.0.18

How to fix

Upgrade to a fixed version: Southrivertech Titan Mft Server 2.0.18; Southrivertech Titan Sftp Server 2.0.18. Check the vendor advisory for mitigations.

References

• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Get alerted when CVE-2023-45689 or the next vulnerability affects your stack