📄 LightFTP Server 2.4 Race Condition

LightFTP versions through 2.4 current master, commit d28c5e0 contain multiple data race conditions in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. !/usr/bin/env python3 LightFTP Server 2.4 Race...

CVE-2026-67607

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-39983

Summary: CVE-2026-39983 affects the Node.js FTP client package basic-ftp prior to v5.2.1. The vulnerability arises from FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level APIs (cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), removeDir()). Th...

GHSA-CHQC-8P9Q-PQ6Q basic-ftp has FTP Command Injection via CRLF

Summary basic-ftp version 5.2.0 allows FTP command injection via CRLF sequences \r\n in file path parameters passed to high-level path APIs such as cd, remove, rename, uploadFrom, downloadTo, list, and removeDir. The library's protectWhitespace helper only handles leading spaces and returns other...