CVE-2026-67193 — Xlight FTP Server < 3.9.5 Information Disclosure via USER Command
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by send…
Published: 2026-07-29 · CVSS: 6.9 · CVSS 4.0
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7