CVE-2024-58299: PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-12 · updated 2026-06-17
Weakness: CWE-121

Description

PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted payload during the FTP login process to overwrite memory and potentially gain system access.

Affected products

PCMan FTP Server: 2.0

References

https://sourceforge.net/projects/pcmanftpd/
https://www.exploit-db.com/exploits/51767
https://www.vulncheck.com/advisories/pcman-ftp-server-remote-buffer-overflow-via-pwd-command

Get alerted when CVE-2024-58299 or the next vulnerability affects your stack