CVE-2026-116844mediumCWE-319

CVE-2026-116844: medium-severity vulnerability in fclairamb ftpserverlib

Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P

Published · Updated

Follow this CVE+ Monitor Syncplify Server!+ Monitor ftpserverlib

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.1%
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
fclairamb · ftpserverlibSyncplify, Inc. · Syncplify Server!
Related CVEs — fclairamb ftpserverlib

In the same product, most dangerous first.

CVE-2026-112343HIGHSyncplify Server! < 8.8.0 Permission Override Bypass via Path CasingEPSS 0.5%CVE-2026-112344HIGHSyncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail EscapeEPSS 0.3%