rustsec-2026-0271
Vulnerability from osv_rustsec
Affected versions of suppaftp wrote command arguments (user name, password, paths, SITE arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (\r) or a line feed (\n) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.
An application that passes untrusted input as credentials, paths or command strings to methods such as login, cwd, mkdir, rmdir, rm, rename, retr, put_file, site or custom_command can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected PORT.
All three clients are affected: sync, tokio and smol, with or without TLS.
The flaw was corrected in version 10.0.2 (commit 194bdd1): every command line is validated before it is written to the wire and rejected with FtpError::ConnectionError (std::io::ErrorKind::InvalidInput) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, custom_command no longer accepts several commands joined by CRLF in a single call.
Users who cannot upgrade should reject or strip \r and \n from any untrusted string before passing it to the client.
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"categories": [
"format-injection"
],
"cvss": null,
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"suppaftp::ImplFtpStream::custom_command",
"suppaftp::ImplFtpStream::cwd",
"suppaftp::ImplFtpStream::login",
"suppaftp::ImplFtpStream::mkdir",
"suppaftp::ImplFtpStream::put_file",
"suppaftp::ImplFtpStream::rename",
"suppaftp::ImplFtpStream::retr",
"suppaftp::ImplFtpStream::rm",
"suppaftp::ImplFtpStream::rmdir",
"suppaftp::ImplFtpStream::site",
"suppaftp::smol::ImplAsyncFtpStream::custom_command",
"suppaftp::smol::ImplAsyncFtpStream::cwd",
"suppaftp::smol::ImplAsyncFtpStream::login",
"suppaftp::smol::ImplAsyncFtpStream::mkdir",
"suppaftp::smol::ImplAsyncFtpStream::put_file",
"suppaftp::smol::ImplAsyncFtpStream::rename",
"suppaftp::smol::ImplAsyncFtpStream::retr",
"suppaftp::smol::ImplAsyncFtpStream::rm",
"suppaftp::smol::ImplAsyncFtpStream::rmdir",
"suppaftp::smol::ImplAsyncFtpStream::site",
"suppaftp::tokio::ImplAsyncFtpStream::custom_command",
"suppaftp::tokio::ImplAsyncFtpStream::cwd",
"suppaftp::tokio::ImplAsyncFtpStream::login",
"suppaftp::tokio::ImplAsyncFtpStream::mkdir",
"suppaftp::tokio::ImplAsyncFtpStream::put_file",
"suppaftp::tokio::ImplAsyncFtpStream::rename",
"suppaftp::tokio::ImplAsyncFtpStream::retr",
"suppaftp::tokio::ImplAsyncFtpStream::rm",
"suppaftp::tokio::ImplAsyncFtpStream::rmdir",
"suppaftp::tokio::ImplAsyncFtpStream::site"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "suppaftp",
"purl": "pkg:cargo/suppaftp"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "10.0.2"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [
"GHSA-8mhj-xm4h-m5m6"
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "Affected versions of `suppaftp` wrote command arguments (user name, password, paths, `SITE` arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (`\\r`) or a line feed (`\\n`) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.\n\nAn application that passes untrusted input as credentials, paths or command strings to methods such as `login`, `cwd`, `mkdir`, `rmdir`, `rm`, `rename`, `retr`, `put_file`, `site` or `custom_command` can therefore be made to execute arbitrary FTP commands with the application\u0027s privileges, for example deleting files or redirecting a data connection with an injected `PORT`.\n\nAll three clients are affected: sync, tokio and smol, with or without TLS.\n\nThe flaw was corrected in version 10.0.2 (commit [194bdd1](https://github.com/veeso/suppaftp/commit/194bdd1979b16c4848d1fad6897dfa524b688d88)): every command line is validated before it is written to the wire and rejected with `FtpError::ConnectionError` (`std::io::ErrorKind::InvalidInput`) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, `custom_command` no longer accepts several commands joined by CRLF in a single call.\n\nUsers who cannot upgrade should reject or strip `\\r` and `\\n` from any untrusted string before passing it to the client.",
"id": "RUSTSEC-2026-0271",
"modified": "2026-08-31T09:17:28Z",
"published": "2026-08-18T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/suppaftp"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0271.html"
},
{
"type": "WEB",
"url": "https://github.com/veeso/suppaftp/pull/172"
}
],
"related": [],
"severity": [],
"summary": "FTP command injection via CRLF in control channel arguments"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.