Medium
Security advisory
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-10916
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:26 UTC · Revision 1
Source evidence
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
osv:CVE-2018-10916
Complete source record
{
"id": "7719777249d1d927b01bede75456bf67350099def0cced5ae65e2e4d02f7af2a",
"url": "https://osv.dev/vulnerability/CVE-2018-10916",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-10916",
"summary": "It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.",
"evidence": "osv:CVE-2018-10916",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-10916",
"aliases": [
"CVE-2018-10916"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/lavv17/lftp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "9459064a276a74b006c1eec4b12ecb2a1327bd5f"
},
{
"fixed": "a27e07d90a4608ceaf928b1babb27d4d803e1992"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:lftp_project:lftp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.8.3"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "a27e07d90a4608ceaf928b1babb27d4d803e1992"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v4.8.3",
"v4.8.2",
"v4.8.1",
"v4.8.0",
"v4.7.7",
"v4.7.6",
"v4.7.5",
"v4.7.4",
"v4.7.3",
"v4.7.2",
"v4.7.1",
"v4.7.0",
"v4.6.4",
"v4.6.3a",
"v4.6.2",
"v4.6.1",
"v4.6.0",
"v4.5.5",
"v4.5.4",
"v4.5.3",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.13",
"v4.4.12",
"v4.4.11",
"v4.4.10",
"lftp-4-4-10",
"v4.4.9",
"lftp-4-4-9",
"lftp-4-4-7",
"lftp-4-4-6",
"lftp-4-3-1",
"lftp-4-3-0",
"lftp-4-2-3",
"lftp-4-2-2",
"lftp-4-2-1",
"lftp-4-2-0",
"lftp-4-1-3",
"lftp-4-1-2",
"lftp-4-1-1",
"lftp-4-1-0",
"lftp-4-0-10",
"lftp-4-0-9",
"lftp-4-0-8",
"lftp-4-0-7",
"lftp-4-0-6",
"lftp-4-0-5",
"lftp-4-0-4",
"lftp-4-0-3",
"lftp-4-0-2",
"lftp-4-0-1",
"lftp-4-0-0",
"lftp-3-7-14",
"lftp-3-7-13",
"lftp-3-7-12",
"lftp-3-7-11",
"lftp-3-7-10",
"lftp-3-7-9",
"lftp-3-7-8",
"lftp-3-7-7",
"lftp-3-7-6",
"lftp-3-7-4",
"lftp-3-7-3",
"lftp-3-7-2",
"lftp-3-7-1",
"lftp-3-7-0",
"lftp-3-6-3",
"lftp-3-6-2",
"lftp-3-6-1",
"lftp-3-6-0",
"lftp-3-5-5",
"lftp-3-5-4",
"lftp-3-5-3",
"lftp-3-5-2",
"lftp-3-5-1",
"lftp-3-5-0",
"lftp-3-4-7",
"lftp-3-4-6",
"lftp-3-4-5",
"lftp-3-4-4",
"lftp-3-4-3",
"lftp-3-4-2",
"lftp-3-4-1",
"lftp-3-4-0",
"lftp-3-3-5",
"lftp-3-3-4",
"lftp-3-3-3",
"lftp-3-3-2",
"lftp-3-3-1",
"lftp-3-3-0",
"lftp-3-2-1",
"lftp-3-1-3",
"lftp-3-2-0",
"lftp-3-1-2",
"lftp-3-1-1",
"lftp-3-1-0",
"lftp-3-0-13",
"lftp-3-0-12",
"lftp-3-0-11",
"lftp-3-0-10",
"lftp-3-0-9",
"lftp-3-0-8",
"lftp-3-0-7",
"lftp-3-0-6",
"lftp-3-0-5",
"lftp-3-0-4",
"lftp-3-0-3",
"lftp-3-0-2",
"lftp-3-0-1",
"lftp-3-0-0",
"lftp-2-6-9",
"lftp-2-6-8",
"lftp-2-6-7",
"lftp-2-6-6",
"lftp-2-6-5",
"lftp-2-6-4",
"lftp-2-6-3",
"lftp-2-6-2",
"lftp-2-6-1a",
"lftp-2-6-1",
"lftp-2-6-0",
"lftp-2-5-4",
"lftp-2-5-3",
"lftp-2-5-2",
"lftp-2-5-1",
"lftp-2-5-0a",
"lftp-2-5-0",
"lftp-2-4-7",
"lftp-2-4-6",
"lftp-2-4-5",
"lftp-2-4-4",
"lftp-2-4-3",
"lftp-2-4-2",
"lftp-2-4-1",
"lftp-2-4-0",
"lftp-2-3-11",
"lftp-2-3-10",
"lftp-2-3-9",
"lftp-2-3-8",
"lftp-2-3-7",
"lftp-2-3-6",
"lftp-2-3-5",
"lftp-2-3-4",
"lftp-2-3-3",
"lftp-2-3-1",
"lftp-2-3-0",
"lftp-2-2-2",
"lftp-2-2-0a",
"lftp-2-2-0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10916.json",
"vanir_signatures": [
{
"id": "CVE-2018-10916-a1d81ad8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244349369390668892595797760314999903510",
"169581960840769298460240584613330507836",
"146173860621971291836711667024800615959",
"265483531252542994341281140526620986764",
"107893587868234888144271310072353078929",
"177756483980309683573063113426513097788",
"288231527058620403338738675996276698652",
"186893300704398393330693503705449305809",
"223082308941403541402446697448846864745",
"246633982740027109863840830855835297073",
"21437594345881515407454960924631063328",
"263669221529071279021023875539765791453",
"173948165701196518792053061803653348440",
"200140341648536081675757215393212583628",
"16159581719100287329306216419001680671",
"190649493202440113952718091698091985904",
"180253791564285096656708248770043869326",
"280245675576124995661559451913257467503",
"200598246181497449339911598896651219367",
"148684542870797260629902892665989974285",
"76746558407179739893964469272790056611",
"29291969798750880168856342168538504014",
"233352089558434665714063550268823556344",
"193065030735708514606678143362412964383",
"193962930268369251624570650910520533367",
"85664116373117485569111148701715145064",
"287534179326712448988736661749163428167",
"305769131065035972015028436761998493066",
"26256688570243295304376914988958272674",
"295539120064017512284362546220385050289",
"207693647384250029276508105234085443761",
"243476246154124037433451746078703124810",
"162797194599769761067522937082633691032",
"200598246181497449339911598896651219367",
"148684542870797260629902892665989974285",
"137882739764527447604796128799422246106",
"229325972409361524971109481980906178033"
]
},
"source": "https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992",
"target": {
"file": "src/MirrorJob.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-10916-deba50ee",
"digest": {
"length": 14791,
"function_hash": "52361239392641749069012112899986580012"
},
"source": "https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992",
"target": {
"file": "src/MirrorJob.cc",
"function": "MirrorJob::Do"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:33:00Z"
}
}
],
"modified": "2026-10-20T13:33:00.938992729Z",
"provider": "osv",
"references": [
"https://usn.ubuntu.com/3731-2/",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916",
"https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992",
"https://github.com/lavv17/lftp/issues/452"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "12.04"
},
{
"last_affected": "12.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "42.3"
},
{
"last_affected": "42.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-10916",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387829,
"published_at": "2018-08-01T14:29:00.44+00:00"
}