WFTPD FTP Server Buffer Overflow

HIGH (10.0) No Patch (9547 days)

Threat Intelligence

⚠️ CRITICAL GAP - Exploits exist but no detection available

EPSS Score: 5.13% chance of exploitation (percentile: 89%)

🔍 Detection Tools: None available in major open-source tools

⚔️ Exploit Availability: Exploit-DB

How we test →

What is it?

The WFTPD FTP server is a widely used open-source FTP server software. This vulnerability allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.

Am I affected?

This is the WFTPD FTP server, NOT vsftpd or other similar FTP servers. You're affected if you use WFTPD versions 2.0.5 through 3.0.3.
Check with: find / -name "wftp*.so" 2>/dev/null

Version info not stated in advisory.

Affected Products

SourceWare / WFTPD

How to fix

Upgrade to WFTPD version 3.0.4 or later from the official website (https://sourceware.org/wftp/).
- Apply patch wftpd-3.0.4.patch (available on SourceForge) using patch -p1 < wftpd-3.0.4.patch.