Back to Database
Status published
Medium
CVE-2020-5221
Directory Traversal (Chroot Escape) vulnerability in uftpd
Vulnerability Description
In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5221
Credits & Attribution
No credits recorded in the NVD database.
References
More from troglobit
View All →CVE-2025-32022
Finit has heap based buffer overwrite in urandom.so plugin
Medium
4.6
CVE-2025-29906
Finit bundled getty can bypass /bin/login
High
8.6
CVE-2022-48620
uev (aka libuev) before 2.4.1 has a buffer overflow in...
Unknown
0
CVE-2020-5204
Buffer overflow vulnerability in uftpd
Medium
6.5
CVE-2020-37182
Redir 3.3 - Denial of Service
High
8.7
Affected Vendor
troglobit
View all reports →Affected Software
uftpd
Vulnerable Versions:
< 2.11
Timeline
Official Publish:
January 22nd, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L