JVN#50367052: EmFTP may insecurely load executable files

EmFTP contains a flaw when loading files, where an unitended executable file may be loaded when attempting to open a file without an extension. For example, if a text file named “exmaple” (without an extension) and an executable “example.exe” are in the same directory, attemtping to open the file “example” will result in the execution of “example.exe”.

Impact

An attacker may execute arbitrary code with the privilege of the vulnerable application.

Solution

Apply a workaround
EmFTP development has ended. The developer recommends the following workaround.

> When opening local files, do not use EmFTP. Use Run command or Windows Explorer.

Products Affected

• EmFTP Standard
• EmFTP Professional