CVE-2025-34110
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.
Reserved 2025-04-15 | Published 2025-07-15 | Updated 2025-07-15 | Assigner VulnCheckCWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-552 Files or Directories Accessible to External Parties
CWE-306 Missing Authentication for Critical Function
RvLaboratory
raw.githubusercontent.com/...r/ftp/colorado_ftp_traversal.rb
www.exploit-db.com/exploits/40231
bitbucket.org/...ts/16a60c4a74ef477cd8c16ca82442eaab2fbe8c86
www.vulncheck.com/...r-path-traversal-information-disclosure
Support options
