FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
Summary
| CVE | CVE-2026-8328 |
|---|---|
| State | PUBLISHED |
| Assigner | PSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-13 21:16:50 UTC |
| Updated | 2026-06-10 19:16:38 UTC |
| Description | The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. |
Risk And Classification
Primary CVSS: v4.0 5.9 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.004010000 probability, percentile 0.317080000 (date 2026-06-16)
Problem Types: CWE-918 | CWE-918 CWE-918 Server-Side request forgery (SSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 5.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
ActiveConfidentiality
NoneIntegrity
HighAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Python Software Foundation | CPython | affected 3.13.14 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.14.0 3.14.6 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.15.0a1 3.15.0b2 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0 | [email protected] | github.com | |
| github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9 | [email protected] | github.com | |
| github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763 | [email protected] | github.com | |
| github.com/python/cpython/pull/149648 | [email protected] | github.com | |
| github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d | [email protected] | github.com | |
| github.com/python/cpython/issues/87451 | [email protected] | github.com | |
| mail.python.org/archives/list/[email protected]/thread/ITF2BAPBQEP... | [email protected] | mail.python.org | |
| github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Qi Deng (https://github.com/ikow) (en)
CNA: Bénédikt Tran (https://github.com/picnixz) (en)
CNA: Gregory P. Smith (https://github.com/gpshead) (en)
There are currently no legacy QID mappings associated with this CVE.