CVE-2024-48208

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the...

8.6 HighPublic exploitFix available

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: High

Exploit likelihood

1.56%Up 1.5 points since Oct 25, 2024

What each source reports

CVE List Score used 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: CVE-2024-48208
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2024-42955 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: EUVD-2024-42955
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rrmj-qxgv-v296 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the...

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: GHSA-rrmj-qxgv-v296
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: CVE-2024-48208
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: CVE-2024-48208
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-48208 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: DEBIAN-CVE-2024-48208
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-48208 8.6

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Record: UBUNTU-CVE-2024-48208
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15266-1 No score

pure-ftpd-1.0.51-5.1 on GA media

These are all security issues fixed in the pure-ftpd-1.0.51-5.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15266-1
Updated: 2026-11-02

Affected products

pureftpd pure-ftpd

Affected packages

Affected packages
Package	Affected	Fixed
`pure-ftpd` Debian:12	All versions, plus listed versions 1.0.50-2.11.0.50-2.21.0.50-2.3	None known
`pure-ftpd` Debian:13	All versions, plus listed versions 1.0.50-2.21.0.50-2.3	None known
`pure-ftpd` Ubuntu:16.04:LTS	All versions, plus listed versions 1.0.36-3.21.0.36-3.2build11.0.36-3.2+deb8u1build0.16.04.1	None known
`pure-ftpd` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.46-11.0.46-1build11.0.46-1ubuntu18.04.1	None known
`pure-ftpd` Ubuntu:20.04:LTS	All versions, plus listed versions 1.0.47-3build11.0.49-11.0.49-21.0.49-31.0.49-41.0.49-4ubuntu0.1	None known
`pure-ftpd` Ubuntu:22.04:LTS	All versions, plus listed versions 1.0.49-4.1build11.0.50-21.0.50-2.11.0.50-2.1ubuntu0.22.04.1	None known
`pure-ftpd` Ubuntu:24.04:LTS	All versions, plus listed versions 1.0.50-2.1build11.0.50-2.1ubuntu11.0.50-2.21.0.50-2.2build11.0.50-2.2build2	None known
`pure-ftpd` Ubuntu:25.10	All versions, plus listed versions 1.0.50-2.2build3	None known
`pure-ftpd` Ubuntu:26.04:LTS	All versions, plus listed versions 1.0.50-2.2build31.0.50-2.2build4	None known
`pure-ftpd` openSUSE:Tumbleweed	before 1.0.51-5.1	1.0.51-5.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Pure-FTPd < 1.0.52 - Buffer Overflow
PoC in GitHub	rohilchaudhry/CVE-2024-48208	2024-10-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48208 is a high vulnerability (CVSS 8.6) in Pureftpd Pure-ftpd, published October 24, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in pure-ftpd 1.0.51-5.1.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

Public exploits

History

In short

References