CVE-2026-8328 PUBLISHED

FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

Assigner: PSF
Reserved: 11.05.2026 Published: 13.05.2026 Updated: 13.05.2026

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	Active

CVSS 4.0

Product Status

Vendor	Python Software Foundation
Product	CPython
Versions	Default: unaffected affected from 0 to 3.15.0 (excl.)

Credits

Qi Deng (https://github.com/ikow) reporter
Bénédikt Tran (https://github.com/picnixz) remediation developer
Gregory P. Smith (https://github.com/gpshead) remediation developer

References

Problem Types

CWE-918 Server-Side request forgery (SSRF) CWE