Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

pyftpdlib FTP Server Allows Remote Users to List Root Directory

CVE-2009-5012 · published 16 years ago
Summary

If you're using an outdated version of pyftpdlib, a remote user with an FTP account can see the root directory of your server, which may contain sensitive information. Update to the latest version of pyftpdlib to fix this issue.

What to do
  • Update giampaolo rodola pyftpdlib to version 0.5.2.
Affected software
Ecosystem VendorProductAffected versions
pip giampaolo rodola pyftpdlib <= 0.5.1
Fix: upgrade to 0.5.2
– g.rodola pyftpdlib <= 0.5.1
0.1
0.1.1
0.2.0
0.3.0
0.4.0
0.5.0
cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:*
Original advisory text
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root direc...
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.1 High
Exploitation
1% chance of attack within 30 days
Type
CWE-284Improper Access Control
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published19 Oct 2010
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-h4g7-8m7r-87r9 · GHSA
CVE-2009-5012 · NVD
Track software like this
Free during beta