{"id":"GHSA-8mhj-xm4h-m5m6","aliases":["RUSTSEC-2026-0271"],"status":"published","title":"FTP command injection via CRLF in control channel arguments","description":"Affected versions of `suppaftp` wrote command arguments (user name, password, paths, `SITE` arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (`\\r`) or a line feed (`\\n`) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.\n\nAn application that passes untrusted input as credentials, paths or command strings to methods such as `login`, `cwd`, `mkdir`, `rmdir`, `rm`, `rename`, `retr`, `put_file`, `site` or `custom_command` can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected `PORT`.\n\nAll three clients are affected: sync, tokio and smol, with or without TLS.\n\nThe flaw was corrected in version 10.0.2 (commit [194bdd1](https://github.com/veeso/suppaftp/commit/194bdd1979b16c4848d1fad6897dfa524b688d88)): every command line is validated before it is written to the wire and rejected with `FtpError::ConnectionError` (`std::io::ErrorKind::InvalidInput`) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, `custom_command` no longer accepts several commands joined by CRLF in a single call.\n\nUsers who cannot upgrade should reject or strip `\\r` and `\\n` from any untrusted string before passing it to the client.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-18T12:00:00Z","modified":"2026-08-31T09:30:02Z","fixes":[{"ecosystem":"crates.io","package":"suppaftp","fixed_in":["10.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"suppaftp","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"10.0.2"}]}]}],"references":[{"url":"https://crates.io/crates/suppaftp","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0271.html","tags":["advisory"]},{"url":"https://github.com/veeso/suppaftp/pull/172","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0271","title":"FTP command injection via CRLF in control channel arguments","description":"Affected versions of `suppaftp` wrote command arguments (user name, password, paths, `SITE` arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (`\\r`) or a line feed (`\\n`) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.\n\nAn application that passes untrusted input as credentials, paths or command strings to methods such as `login`, `cwd`, `mkdir`, `rmdir`, `rm`, `rename`, `retr`, `put_file`, `site` or `custom_command` can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected `PORT`.\n\nAll three clients are affected: sync, tokio and smol, with or without TLS.\n\nThe flaw was corrected in version 10.0.2 (commit [194bdd1](https://github.com/veeso/suppaftp/commit/194bdd1979b16c4848d1fad6897dfa524b688d88)): every command line is validated before it is written to the wire and rejected with `FtpError::ConnectionError` (`std::io::ErrorKind::InvalidInput`) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, `custom_command` no longer accepts several commands joined by CRLF in a single call.\n\nUsers who cannot upgrade should reject or strip `\\r` and `\\n` from any untrusted string before passing it to the client.","status":"published","published":"2026-08-18T12:00:00Z","modified":"2026-08-31T09:30:02.873740969Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}