CVE catalog

CVE-2010-2251

lftp: CVE-2010-2251

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.63% · Oct 25, 2026

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlftpsid4.9.3-3fixed
Debianlftpforky4.9.3-3fixed
Debianlftptrixie4.9.2-3fixed
Debianlftpbookworm4.9.2-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlftpsourcesid4.0.6-1lowNot reportedNot reported
Debianlftpsourceforky4.0.6-1lowNot reportedNot reported
Debianlftpsourcetrixie4.0.6-1lowNot reportedNot reported
Debianlftpsourcebookworm4.0.6-1lowNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [lftp]Fixed
    Details (2)

    • 4.9.2-2 · arm64 · bookworm

      Fixed · Fixed: 4.0.6-1

      dsa · lftp · debian · bookworm; dsa · lftp · debian · 12

    • 4.9.2-2+b1 · amd64 · bookworm

      Fixed · Fixed: 4.0.6-1

      dsa · lftp · debian · bookworm; dsa · lftp · debian · 12

[Debian 13 (Trixie)]

  • [lftp]Fixed
    Details (2)

    • 4.9.2-3 · arm64 · trixie

      Fixed · Fixed: 4.0.6-1

      dsa · lftp · debian · 13

    • 4.9.2-3+b1 · amd64 · trixie

      Fixed · Fixed: 4.0.6-1

      dsa · lftp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]