Cleartext Transmission Vulnerability in Fclairamb FTP Server Library

CVE-2026-116844

What is CVE-2026-116844?

The Fclairamb ftpserverlib version 0.32.4 has a vulnerability that allows for cleartext transmission of sensitive data. This weakness arises because the TransferOpen function only verifies the transferTLS flag set by the PROT command, without checking if the actual data connection is encrypted using TLS. Consequently, when a client initiates a secure transfer with PROT P after using PASV or PORT commands, the file contents and directory listings may be transmitted in plaintext across the network. This exposes the data to potential on-path attackers who can intercept, read, or modify the information despite the expectation of mandatory encryption.

References