Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-116844Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P

Medium 4.8

In plain English

A medium-severity security flaw in ftpserverlib from fclairamb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)<0.1%top 99.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.

Affected products (as reported)

Vendor	Product	Versions
fclairamb	ftpserverlib	0 – through 0.32.4
Syncplify, Inc.	Syncplify Server!	0 – through 8.8.0

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/fclairamb/ftpserverlib/pull/685 patch, issue-tracking
https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/handle_misc.go#L29-L31 technical-description
https://github.com/fclairamb/ftpserverlib/blob/v0.32.4/client_handler.go#L720 technical-description
VulnCheck Advisory: Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P third-party-advisory