CVE-2007-6738: pyftpdlib Information Disclosure Vulnerability
Summary
CVE-2007-6738: pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress... Affects pyftpdlib versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to easily create custom FTP servers with various features. This vulnerability affects versions prior to 0.1.1 of pyftpdlib. The vulnerability lies in the way the library handles the PASV command, where it does not choose a random value for the port associated with the command. This makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.
Vulnerability Detail
The vulnerability in pyftpdlib allows remote attackers to gather information about the number of in-progress data connections. By exploiting this vulnerability, an attacker can gain insights into the server's activity and potentially gather sensitive information. This information disclosure can be used for further attacks or reconnaissance purposes. It is important to note that this vulnerability does not allow unauthorized access or modification of data, but it can aid in planning and executing subsequent attacks.
How To Fix
Latest published version: 2.2.0 as of 23 Oct 2026
pip install --upgrade "pyftpdlib==2.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.1
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to manually modify the code to ensure a random value is chosen for the port associated with the PASV command. Here is an example of how this can be done:
import random
# Inside the handle_PASV method
port = random.randint(1024, 65535)
Conclusion
pyftpdlib versions prior to 0.1.1 are vulnerable to an information disclosure vulnerability. Upgrading to version 0.1.1 or later is recommended to mitigate this vulnerability. If immediate upgrade is not possible, a workaround is available by manually modifying the code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
This vulnerability allows remote attackers to gather information about the number of in-progress data connections, potentially aiding in further attacks or reconnaissance.
To fix this vulnerability, upgrade to version 0.1.1 or later of pyftpdlib.
Yes, a possible workaround is to manually modify the code to ensure a random value is chosen for the port associated with the PASV command.
No, this vulnerability only allows information disclosure and does not provide unauthorized access or data modification capabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
