CVE-2020-20277 - CVE House
Back to Database
Status published Critical CVE-2020-20277

There are multiple unauthenticated directory traversal vulnerabilities in different FTP...

Vulnerability Description

There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-20277

Credits & Attribution

No credits recorded in the NVD database.

References

More from troglobit

View All →
CVE-2025-32022
Finit has heap based buffer overwrite in urandom.so plugin
Medium 4.6
CVE-2025-29906
Finit bundled getty can bypass /bin/login
High 8.6
CVE-2022-48620
uev (aka libuev) before 2.4.1 has a buffer overflow in...
Unknown 0
CVE-2020-5221
Directory Traversal (Chroot Escape) vulnerability in uftpd
Medium 6.5
CVE-2020-5204
Buffer overflow vulnerability in uftpd
Medium 6.5

Affected Vendor

Affected Software

uftpd
Vulnerable Versions:
2.7

Timeline

Official Publish: December 18th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.