CVE-2026-8328

medium

Description

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

References

https://mail.python.org/archives/list/[email protected]/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/

https://github.com/python/cpython/pull/149648

https://github.com/python/cpython/issues/87451

https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9

https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d

https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763

https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0

https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06

Details

Source: Mitre, NVD

Published: 2026-05-13

Updated: 2026-06-10

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 5.9

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00039