Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Titan FTP Server lets logged-in users view any file

CVE-2019-10009 · published 7 years ago
Summary

The web interface of Titan FTP Server 2019 (build 3505) can be tricked by a signed-in user into showing files that are stored outside the allowed folder. This could expose sensitive system or private files to anyone who can log in. Apply the latest update from the vendor or restrict access to the preview feature until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
southrivertech titan_ftp_server 2019
cpe:2.3:a:southrivertech:titan_ftp_server:2019:3505:*:*:*:*:*:*
Original advisory text
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using...
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
11% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published3 Jun 2019
Updated18 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-10009 · NVD
Track software like this
Free during beta