CVE catalog
CVE-2007-2348
lftp: CVE-2007-2348
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.17% · Oct 25, 2026
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | lftp | sid | 4.9.3-3 | fixed |
| Debian | lftp | forky | 4.9.3-3 | fixed |
| Debian | lftp | trixie | 4.9.2-3 | fixed |
| Debian | lftp | bookworm | 4.9.2-2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | lftp | source | sid | 3.5.9-1 | unimportant | Not reported | Not reported |
| Debian | lftp | source | forky | 3.5.9-1 | unimportant | Not reported | Not reported |
| Debian | lftp | source | trixie | 3.5.9-1 | unimportant | Not reported | Not reported |
| Debian | lftp | source | bookworm | 3.5.9-1 | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [lftp]Fixed
Details (2)
4.9.2-2· arm64 · bookwormFixed · Fixed:
3.5.9-1dsa · lftp · debian · bookworm; dsa · lftp · debian · 12
4.9.2-2+b1· amd64 · bookwormFixed · Fixed:
3.5.9-1dsa · lftp · debian · bookworm; dsa · lftp · debian · 12
[Debian 13 (Trixie)]
- [lftp]Fixed
Details (2)
4.9.2-3· arm64 · trixieFixed · Fixed:
3.5.9-1dsa · lftp · debian · 13
4.9.2-3+b1· amd64 · trixieFixed · Fixed:
3.5.9-1dsa · lftp · debian · 13
Observed: