CVE-2007-4756
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote...
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename. NOTE: the ".." are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename. NOTE: the ".." are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
CVE-2007-4756- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename. NOTE: the ".." are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
CVE-2007-4756- Updated
- 2026-11-02
EUVDEUVD-2007-4737 No score
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename. NOTE: the ".." are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
EUVD-2007-4737- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mrgj-rjgm-ffp5 No score
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote...
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename. NOTE: the ".." are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
GHSA-mrgj-rjgm-ffp5- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4756 is a medium vulnerability (CVSS 6.8) in Ghisler Total Commander, published September 8, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.64%, the 89th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/478720/100/0/threaded
secunia.com/advisories/26734
osvdb.org/39838
ghisler.com/whatsnew.htm
securityreason.com/securityalert/3106
Show 7 moreShow less
blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt
exchange.xforce.ibmcloud.com/vulnerabilities/36487
vupen.com/english/advisories/2007/3102
securitytracker.com/id?1018662
nvd.nist.gov/vuln/detail/CVE-2007-4756
github.com/advisories/GHSA-mrgj-rjgm-ffp5