CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize...
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
CVE-2018-10916- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2018-2971
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
EUVD-2018-2971- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mjf-52xq-g6h8
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize...
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
GHSA-8mjf-52xq-g6h8- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
CVE-2018-10916- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 7.8 High
AV:N/AC:M/Au:N/C:N/I:P/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
ALPINE-CVE-2018-10916- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
CVE-2018-10916- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
DEBIAN-CVE-2018-10916- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2020:1045
Red Hat Security Advisory: lftp security update
- Record
RHSA-2020:1045- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Record
UBUNTU-CVE-2018-10916- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1110-1 No score
Security update for lftp
This update for lftp fixes the following issues: Security issue fixed:
- CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367).
Other issue addressed:
- The SSH login handling code detects password prompts more reliably (bsc#1120946).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1110-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10915-1 No score
lftp-4.9.2-1.7 on GA media
These are all security issues fixed in the lftp-4.9.2-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10915-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0642-1 No score
Security update for lftp
This update for lftp fixes the following issues:
Security issue fixed:
- CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367).
Other issue addressed:
- The SSH login handling code detects password prompts more reliably (bsc#1120946).
- Record
SUSE-SU-2019:0642-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0643-1 No score
Security update for lftp
This update for lftp fixes the following issues: Security issue fixed:
- CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367).
Other issue addressed:
- The SSH login handling code detects password prompts more reliably (bsc#1120946).
- Record
SUSE-SU-2019:0643-1- Updated
- 2026-11-02
OSVUSN-3731-1 No score
lftp vulnerability
It was discovered that LFTP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-3731-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lftpAlpine:v3.10 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.11 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.12 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.13 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.14 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.15 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.16 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.17 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.18 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.19 |
before 4.8.4-r0 | 4.8.4-r0 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lftpAlpine:v3.20 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.21 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.22 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.23 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.24 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpAlpine:v3.9 |
before 4.8.4-r0 | 4.8.4-r0 |
lftpDebian:12 |
before 4.8.4-1 | 4.8.4-1 |
lftpDebian:13 |
before 4.8.4-1 | 4.8.4-1 |
lftpDebian:14 |
before 4.8.4-1 | 4.8.4-1 |
lftpRed Hat:enterprise_linux:7::client |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-debuginfoRed Hat:enterprise_linux:7::client |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-scriptsRed Hat:enterprise_linux:7::client |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftpRed Hat:enterprise_linux:7::computenode |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-scriptsRed Hat:enterprise_linux:7::computenode |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftpRed Hat:enterprise_linux:7::server |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-debuginfoRed Hat:enterprise_linux:7::server |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-scriptsRed Hat:enterprise_linux:7::server |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftpRed Hat:enterprise_linux:7::workstation |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftp-scriptsRed Hat:enterprise_linux:7::workstation |
before 0:4.4.8-12.el7 | 0:4.4.8-12.el7 |
lftpSUSE:Linux Enterprise Desktop 12 SP3 |
before 4.7.4-3.6.1 | 4.7.4-3.6.1 |
lftpSUSE:Linux Enterprise Desktop 12 SP4 |
before 4.7.4-3.6.1 | 4.7.4-3.6.1 |
lftpSUSE:Linux Enterprise Server 12 SP3 |
before 4.7.4-3.6.1 | 4.7.4-3.6.1 |
lftpSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 4.7.4-3.6.1 | 4.7.4-3.6.1 |
lftpSUSE:Linux Enterprise Server 12 SP4 |
before 4.7.4-3.6.1 | 4.7.4-3.6.1 |
lftpSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 4.7.4-3.6.1 | 4.7.4-3.6.1 |
lftpSUSE:Linux Enterprise Module for Basesystem 15 |
before 4.8.3-4.3.1 | 4.8.3-4.3.1 |
lftpUbuntu:14.04:LTS |
before 4.4.13-1ubuntu0.1, plus listed versions 4.4.9-14.4.10-14.4.11-14.4.13-1 |
4.4.13-1ubuntu0.1 |
lftpUbuntu:16.04:LTS |
before 4.6.3a-1ubuntu0.1, plus listed versions 4.6.3a-14.6.3a-1build14.6.3a-1build2 |
4.6.3a-1ubuntu0.1 |
lftpUbuntu:18.04:LTS |
before 4.8.1-1ubuntu0.1, plus listed versions 4.8.0-34.8.1-1 |
4.8.1-1ubuntu0.1 |
lftpopenSUSE:Leap 15.0 |
before 4.8.3-lp150.3.3.1 | 4.8.3-lp150.3.3.1 |
lftpopenSUSE:Tumbleweed |
before 4.9.2-1.7 | 4.9.2-1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10916 is a medium vulnerability (CVSS 5.3) in [unknown] Lftp, published August 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.78%, the 91st percentile. Fixed in lftp 4.8.4-r0.
References
github.com/lavv17/lftp/issues/452
usn.ubuntu.com/3731-2
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916
lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-10916
security.alpinelinux.org/vuln/CVE-2018-10916
security-tracker.debian.org/tracker/CVE-2018-10916
access.redhat.com/errata/RHSA-2020:1045
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1045.json
cve.org/CVERecord?id=CVE-2018-10916
suse.com/support/update/announcement/2019/suse-su-20190642-1
bugzilla.suse.com/1103367
ubuntu.com/security/CVE-2018-10916