Vulnerability · Published Jul 29, 2026 · Assigned by VulnCheck

CVE-2026-67193Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

Medium 5.3

In plain English

A medium-severity security flaw in Xlight FTP Server from Xlight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.

Affected products (as reported)

Vendor	Product	Versions
Xlight	Xlight FTP Server	0 – before 3.9.5

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Changelog release-notes
https://www.vulncheck.com/advisories/xlight-ftp-server-information-disclosure-via-user-command third-party-advisory