mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade lftp | Dec 1, 2016 | Apr 27, 2007 |
| Debian | — | Upgrade lftp | Jul 30, 2024 | Apr 27, 2007 |
| Oracle_linux | — | Upgrade lftp | Oct 16, 2024 | Apr 27, 2007 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 9, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub