Read the docs
TI-2009-04768 Aliases CVE-2009-5012GHSA-h4g7-8m7r-87r9

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST…

Priority LOW 21CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264.

Summary

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

Why it matters now

EPSS 0.01012 63rd percentileScored 2026-11-07
Fix Fixed pyftpdlib (PyPI): 0.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pyftpdlib (PyPI)before 0.5.20.5.2Patch availableGHSA-h4g7-8m7r-87r9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pyftpdlib (PyPI) Vendor— Affected before 0.5.2 Fixed in 0.5.2 Patch available GHSA-h4g7-8m7r-87r9

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:*up to 0.5.1VulnerableG.rodola
cpe:2.3:a:g.rodola:pyftpdlib:0.1:*:*:*:*:*:*:*0.1VulnerableG.rodola
cpe:2.3:a:g.rodola:pyftpdlib:0.1.1:*:*:*:*:*:*:*0.1.1VulnerableG.rodola
cpe:2.3:a:g.rodola:pyftpdlib:0.2.0:*:*:*:*:*:*:*0.2.0VulnerableG.rodola
cpe:2.3:a:g.rodola:pyftpdlib:0.3.0:*:*:*:*:*:*:*0.3.0VulnerableG.rodola
cpe:2.3:a:g.rodola:pyftpdlib:0.4.0:*:*:*:*:*:*:*0.4.0VulnerableG.rodola
cpe:2.3:a:g.rodola:pyftpdlib:0.5.0:*:*:*:*:*:*:*0.5.0VulnerableG.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:* Versions up to 0.5.1 Vulnerable ·G.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·G.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:0.1.1:*:*:*:*:*:*:* Versions 0.1.1 Vulnerable ·G.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·G.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:0.3.0:*:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·G.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·G.rodola
  • cpe:2.3:a:g.rodola:pyftpdlib:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·G.rodola

Remediation

  • Fix · GHSA-h4g7-8m7r-87r9 pyftpdlib (PyPI) Fixed in 0.5.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-5012
  2. 2026-10-03 Alias added: GHSA-h4g7-8m7r-87r9

References

Advisory 1

Other 6

  • TI-2007-06431 FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for… CVSS 2.0HIGH 7.5
  • TI-2008-06949 ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an… CVSS 2.0HIGH 7.5
  • TI-2008-06948 Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0… CVSS 2.0MEDIUM 6.5
  • TI-2007-06430 Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0… CVSS 2.0MEDIUM 6.5
  • TI-2007-06435 The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP… CVSS 2.0MEDIUM 6.5
  • TI-2007-06433 FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command. CVSS 2.0MEDIUM 5.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences