{"id":"CVE-2018-10916","aliases":["ALPINE-CVE-2018-10916","DEBIAN-CVE-2018-10916","EUVD-2018-2971","GHSA-8mjf-52xq-g6h8","RHSA-2020:1045","SUSE-SU-2019:0642-1","SUSE-SU-2019:0643-1","UBUNTU-CVE-2018-10916","USN-3731-1","openSUSE-SU-2019:1110-1","openSUSE-SU-2024:10915-1"],"status":"published","title":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize...","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.04782,"percentile":0.91982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-08-01T00:00:00Z","modified":"2026-10-23T18:02:56Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"lftp","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lftp","fixed_in":["4.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lftp","fixed_in":["4.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lftp","fixed_in":["4.8.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"lftp","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"lftp-debuginfo","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"lftp-scripts","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lftp","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lftp-debuginfo","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lftp-scripts","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lftp","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lftp-debuginfo","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lftp-scripts","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lftp","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lftp-debuginfo","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lftp-scripts","fixed_in":["0:4.4.8-12.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"lftp","fixed_in":["4.7.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"lftp","fixed_in":["4.7.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"lftp","fixed_in":["4.7.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"lftp","fixed_in":["4.7.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"lftp","fixed_in":["4.7.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"lftp","fixed_in":["4.7.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"lftp","fixed_in":["4.8.3-4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"lftp","fixed_in":["4.4.13-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"lftp","fixed_in":["4.6.3a-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"lftp","fixed_in":["4.8.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"lftp","fixed_in":["4.8.3-lp150.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lftp","fixed_in":["4.9.2-1.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"lftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"lftp-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"lftp-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lftp-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lftp-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.8-12.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.3-4.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-1ubuntu0.1"}]}],"versions":["4.4.9-1","4.4.10-1","4.4.11-1","4.4.13-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3a-1ubuntu0.1"}]}],"versions":["4.6.3a-1","4.6.3a-1build1","4.6.3a-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1ubuntu0.1"}]}],"versions":["4.8.0-3","4.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-1ubuntu0.1"}]}],"versions":["4.4.9-1","4.4.10-1","4.4.11-1","4.4.13-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3a-1ubuntu0.1"}]}],"versions":["4.6.3a-1","4.6.3a-1build1","4.6.3a-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1ubuntu0.1"}]}],"versions":["4.8.0-3","4.8.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.3-lp150.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1.7"}]}]}],"products":[{"vendor":"[unknown]","product":"lftp"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"lftp_project","product":"lftp"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://github.com/lavv17/lftp/issues/452","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://usn.ubuntu.com/3731-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10916","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8mjf-52xq-g6h8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-10916","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10916","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1045","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1610349","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1045.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10916","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190642-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1103367","tags":["report"]},{"url":"https://bugzilla.suse.com/1120946","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10916","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190643-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-10916","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3731-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3731-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZZFM7KI5WN2TTJGW46TEIEVSEIISQ7N3/#ZZFM7KI5WN2TTJGW46TEIEVSEIISQ7N3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-10916","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T14:00:00Z","modified":"2024-08-05T07:54:35.215Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:01.619448Z"}],"euvd":[{"id":"EUVD-2018-2971","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T14:00:00Z","modified":"2024-08-05T07:54:35Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:57.009215Z"}],"ghsa":[{"id":"GHSA-8mjf-52xq-g6h8","title":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize...","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2022-05-14T01:14:04Z","modified":"2023-02-02T05:03:20Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:51:37.12522Z"}],"nvd":[{"id":"CVE-2018-10916","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T14:29:00.44Z","modified":"2026-06-17T01:34:54.937Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"ALPINE-CVE-2018-10916","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T14:29:00.44Z","modified":"2026-10-23T17:17:55.20104141Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-10916","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T14:29:00.44Z","modified":"2026-10-20T13:33:00.938992729Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10916","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T14:29:00.44Z","modified":"2026-10-23T18:02:56.971003618Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2020:1045","title":"Red Hat Security Advisory: lftp security update","status":"published","published":"2024-09-16T02:47:50Z","modified":"2026-07-01T10:05:41Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-10916","description":"It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.","status":"published","published":"2018-08-01T00:00:00Z","modified":"2026-02-04T04:32:20.901537Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"openSUSE-SU-2019:1110-1","title":"Security update for lftp","description":"This update for lftp fixes the following issues:\nSecurity issue fixed: \n\n- CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of \n  the local system (bsc#1103367).\n  \nOther issue addressed:\n\n- The SSH login handling code detects password prompts more reliably (bsc#1120946).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-02T11:03:15Z","modified":"2026-02-04T03:55:42.926622Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10915-1","title":"lftp-4.9.2-1.7 on GA media","description":"These are all security issues fixed in the lftp-4.9.2-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:56.338289Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0642-1","title":"Security update for lftp","description":"This update for lftp fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of \n  the local system (bsc#1103367).\n  \nOther issue addressed:\n\n- The SSH login handling code detects password prompts more reliably (bsc#1120946).\n","status":"published","published":"2019-03-19T13:28:13Z","modified":"2026-02-04T03:04:12.174919Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0643-1","title":"Security update for lftp","description":"This update for lftp fixes the following issues:\nSecurity issue fixed: \n\n- CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of \n  the local system (bsc#1103367).\n  \nOther issue addressed:\n\n- The SSH login handling code detects password prompts more reliably (bsc#1120946).\n","status":"published","published":"2019-03-19T14:14:58Z","modified":"2026-02-04T03:57:46.031516Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3731-1","title":"lftp vulnerability","description":"It was discovered that LFTP incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2018-08-06T17:35:06Z","modified":"2026-02-10T04:41:23Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}