Buffer overflow in Easyftp Server Project
CVE-2010-20113
EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.
Vulnerability class: Buffer Overflow
EPSS: 0.016 (72.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (Exploit, Third Party Advisory, exploit)
- disclosure@vulncheck.com (Exploit, VDB Entry, exploit)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2010-20113?
- CVE-2010-20113 is a critical-severity vulnerability in Easyftp Server Project, classified under Stack-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-08-21.
- How severe is CVE-2010-20113?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2010-20113 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.