Directory traversal vulnerability in WinFrigate Frigate 3 FTP client 3.36 and earlier…
Priority MEDIUM 43CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Directory traversal vulnerability in WinFrigate Frigate 3 FTP client 3.36 and earlier allows remote FTP servers to overwrite arbitrary files via a "..\" (dot dot backslash) in a filename.
Why it matters now
EPSS 0.0152 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:winfrigate:frigate_3:*:*:*:*:*:*:*:* | up to 3.36 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.17:*:*:*:*:*:*:* | 3.17 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.18:*:*:*:*:*:*:* | 3.18 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.19:*:*:*:*:*:*:* | 3.19 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.20:*:*:*:*:*:*:* | 3.20 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.21:*:*:*:*:*:*:* | 3.21 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.22:*:*:*:*:*:*:* | 3.22 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.23:*:*:*:*:*:*:* | 3.23 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.24:*:*:*:*:*:*:* | 3.24 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.25:*:*:*:*:*:*:* | 3.25 | Vulnerable | WinFrigate |
- cpe:2.3:a:winfrigate:frigate_3:*:*:*:*:*:*:*:* Versions up to 3.36 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.17:*:*:*:*:*:*:* Versions 3.17 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.18:*:*:*:*:*:*:* Versions 3.18 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.19:*:*:*:*:*:*:* Versions 3.19 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.20:*:*:*:*:*:*:* Versions 3.20 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.21:*:*:*:*:*:*:* Versions 3.21 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.22:*:*:*:*:*:*:* Versions 3.22 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.23:*:*:*:*:*:*:* Versions 3.23 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.24:*:*:*:*:*:*:* Versions 3.24 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.25:*:*:*:*:*:*:* Versions 3.25 Vulnerable ·WinFrigate
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:winfrigate:frigate_3:3.26:*:*:*:*:*:*:* | 3.26 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.27:*:*:*:*:*:*:* | 3.27 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.28:*:*:*:*:*:*:* | 3.28 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.29:*:*:*:*:*:*:* | 3.29 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.30:*:*:*:*:*:*:* | 3.30 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.31:*:*:*:*:*:*:* | 3.31 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.32:*:*:*:*:*:*:* | 3.32 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.33:*:*:*:*:*:*:* | 3.33 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.34:*:*:*:*:*:*:* | 3.34 | Vulnerable | WinFrigate |
| cpe:2.3:a:winfrigate:frigate_3:3.35:*:*:*:*:*:*:* | 3.35 | Vulnerable | WinFrigate |
- cpe:2.3:a:winfrigate:frigate_3:3.26:*:*:*:*:*:*:* Versions 3.26 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.27:*:*:*:*:*:*:* Versions 3.27 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.28:*:*:*:*:*:*:* Versions 3.28 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.29:*:*:*:*:*:*:* Versions 3.29 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.30:*:*:*:*:*:*:* Versions 3.30 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.31:*:*:*:*:*:*:* Versions 3.31 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.32:*:*:*:*:*:*:* Versions 3.32 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.33:*:*:*:*:*:*:* Versions 3.33 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.34:*:*:*:*:*:*:* Versions 3.34 Vulnerable ·WinFrigate
- cpe:2.3:a:winfrigate:frigate_3:3.35:*:*:*:*:*:*:* Versions 3.35 Vulnerable ·WinFrigate
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2010-3097
- 2026-10-03 Alias added: GHSA-596f-wggj-27mj
References
Sources
- CVE-2010-3097 · CVE Program
- CVE-2010-3097 · NVD
- FIRST EPSS
- GHSA-596f-wggj-27mj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences