CVE-2020-5221 — Directory Traversal (Chroot Escape) vulnerability in uftpd
In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary lo…
Published: 2020-01-22 · CVSS: 6.5 · CVSS 3.1
In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7