CVE-2008-7263: pyftpdlib - Brute-force Attack Vulnerability
Summary
CVE-2008-7263: ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack. Affects pyftpdlib versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with various features and configurations. However, versions prior to 0.5.0 are vulnerable to a brute-force attack due to a lack of delay in response after receiving an invalid login attempt.
Vulnerability Detail
The vulnerability in pyftpdlib allows remote attackers to exploit the FTP server by conducting a brute-force attack. By repeatedly attempting to log in with different credentials, an attacker can eventually gain unauthorized access to the server. This vulnerability poses a significant risk as it can lead to unauthorized access to sensitive data, unauthorized file transfers, and potential compromise of the entire FTP server.
How To Fix
Latest published version: 2.2.0 as of 23 Oct 2026
pip install --upgrade "pyftpdlib==2.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating pyftpdlib is not immediately feasible, a workaround can be implemented by modifying the source code of the library. By introducing a delay in the response after receiving an invalid login attempt, the vulnerability can be mitigated. Below is an example of how the delay can be added:
# Add a delay of 1 second after an invalid login attempt
if not valid_login:
time.sleep(1)
Conclusion
The vulnerability in pyftpdlib allows remote attackers to exploit the FTP server through brute-force attacks. To mitigate this risk, it is crucial to update pyftpdlib to version 0.5.0 or later. Alternatively, a workaround can be implemented by introducing a delay in the response after receiving an invalid login attempt. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
This vulnerability allows remote attackers to perform brute-force attacks and gain unauthorized access to the FTP server, potentially compromising sensitive data and enabling unauthorized file transfers.
To fix this vulnerability, update pyftpdlib to version 0.5.0 or later.
Yes, a workaround is available by introducing a delay in the response after receiving an invalid login attempt. See the 'workaround' section for more details.
You can find more information about this vulnerability in the pyftpdlib advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pyftpdlib/PYSEC-2010-5.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
