CVE-2007-6736: Directory Traversal Vulnerabilities in pyftpdlib
Summary
CVE-2007-6736: Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. Affects pyftpdlib versions < 0.2.0. Fixed in 0.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It is available on the Python Package Index (PyPI) and is widely used for creating FTP servers in Python applications. However, versions prior to 0.2.0 are vulnerable to multiple directory traversal vulnerabilities.
Vulnerability Detail
The vulnerability allows remote authenticated users to access arbitrary files and directories by exploiting directory traversal flaws in the LIST, STOR, and RETR commands of FTPServer.py. By including '..' (dot dot) sequences in these commands, an attacker can bypass access restrictions and retrieve or manipulate files and directories outside of the intended scope.
How To Fix
Latest published version: 2.2.0 as of 23 Oct 2026
pip install --upgrade "pyftpdlib==2.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and filtering on the server-side to prevent the inclusion of '..' sequences in user-supplied commands. This can be achieved by checking the command arguments for any occurrence of '..' and rejecting or sanitizing them before processing the command.
Conclusion
In conclusion, pyftpdlib versions prior to 0.2.0 are vulnerable to directory traversal attacks, allowing authenticated users to access arbitrary files and directories. It is crucial to upgrade to version 0.2.0 or later to mitigate these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
These vulnerabilities allow authenticated users to access sensitive files and directories outside of the intended scope, potentially leading to unauthorized disclosure, modification, or deletion of data.
No, this vulnerability requires authentication to exploit. Anonymous users do not have the necessary privileges to execute the affected commands.
There is no known evidence of active exploitation of these vulnerabilities at the time of this advisory. However, it is recommended to apply the necessary patches or upgrades to mitigate the risk.
Yes, these vulnerabilities can be exploited remotely by authenticated users. However, an attacker would need valid credentials to access the FTP server.
At the time of this advisory, there are no known alternative FTP server libraries that are affected by the same directory traversal vulnerabilities. It is recommended to upgrade pyftpdlib to the latest patched version.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
