Critical severity9.8NVD Advisory· Published Dec 18, 2020· Updated Jun 17, 2026

CVE-2020-20277

Description

There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Troglobit/uftpd2 versions
cpe:2.3:a:troglobit:uftpd:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:troglobit:uftpd:*:*:*:*:*:*:*:*range: >=2.7,<=2.10
- (no CPE)range: 2.7 - 2.10
uftpd/uftpd FTP serverdescription
Uftpd/uftpdllm-fuzzy
Range: 2.7 - 2.10

Patches

Vulnerability mechanics

References

github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fenvdPatchThird Party Advisory
packetstormsecurity.com/files/167908/uftpd-2.10-Directory-Traversal.htmlnvdExploitThird Party AdvisoryVDB Entry
arinerron.com/blog/posts/6nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.020
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000