Read the docs
TI-2011-03739 Aliases CVE-2011-4266GHSA-r7xc-f7xc-395f

Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file, a different vulnerability than CVE-2011-3991.

Why it matters now

EPSS 0.01815 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:ffftp:ffftp:*:c:*:*:*:*:*:*up to 1.98VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.79a:*:*:*:*:*:*:*1.79aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.80:*:*:*:*:*:*:*1.80VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.81:*:*:*:*:*:*:*1.81VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.82:*:*:*:*:*:*:*1.82VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.83:*:*:*:*:*:*:*1.83VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.84:*:*:*:*:*:*:*1.84VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.85:*:*:*:*:*:*:*1.85VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.86:*:*:*:*:*:*:*1.86VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.86a:*:*:*:*:*:*:*1.86aVulnerableFfftp
  • cpe:2.3:a:ffftp:ffftp:*:c:*:*:*:*:*:* Versions up to 1.98 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.79a:*:*:*:*:*:*:* Versions 1.79a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.80:*:*:*:*:*:*:* Versions 1.80 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.81:*:*:*:*:*:*:* Versions 1.81 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.82:*:*:*:*:*:*:* Versions 1.82 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.83:*:*:*:*:*:*:* Versions 1.83 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.84:*:*:*:*:*:*:* Versions 1.84 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.85:*:*:*:*:*:*:* Versions 1.85 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.86:*:*:*:*:*:*:* Versions 1.86 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.86a:*:*:*:*:*:*:* Versions 1.86a Vulnerable ·Ffftp
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ffftp:ffftp:1.87:*:*:*:*:*:*:*1.87VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.87a:*:*:*:*:*:*:*1.87aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.88:*:*:*:*:*:*:*1.88VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.88a:*:*:*:*:*:*:*1.88aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.88b:*:*:*:*:*:*:*1.88bVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.89:*:*:*:*:*:*:*1.89VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.89a:*:*:*:*:*:*:*1.89aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.89b:*:*:*:*:*:*:*1.89bVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.90:*:*:*:*:*:*:*1.90VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.91:*:*:*:*:*:*:*1.91VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.92:*:*:*:*:*:*:*1.92VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.92a:*:*:*:*:*:*:*1.92aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.92b:*:*:*:*:*:*:*1.92bVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.92c:*:*:*:*:*:*:*1.92cVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.93:*:*:*:*:*:*:*1.93VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.94:*:*:*:*:*:*:*1.94VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.94a:*:*:*:*:*:*:*1.94aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.95:*:*:*:*:*:*:*1.95VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.96:*:*:*:*:*:*:*1.96VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.96a:*:*:*:*:*:*:*1.96aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.96b:*:*:*:*:*:*:*1.96bVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.96c:*:*:*:*:*:*:*1.96cVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.96d:*:*:*:*:*:*:*1.96dVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.97:*:*:*:*:*:*:*1.97VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.97a:*:*:*:*:*:*:*1.97aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.97b:*:*:*:*:*:*:*1.97bVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.98:*:*:*:*:*:*:*1.98VulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.98:a:*:*:*:*:*:*1.98 aVulnerableFfftp
cpe:2.3:a:ffftp:ffftp:1.98:b:*:*:*:*:*:*1.98 bVulnerableFfftp
  • cpe:2.3:a:ffftp:ffftp:1.87:*:*:*:*:*:*:* Versions 1.87 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.87a:*:*:*:*:*:*:* Versions 1.87a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.88:*:*:*:*:*:*:* Versions 1.88 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.88a:*:*:*:*:*:*:* Versions 1.88a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.88b:*:*:*:*:*:*:* Versions 1.88b Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.89:*:*:*:*:*:*:* Versions 1.89 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.89a:*:*:*:*:*:*:* Versions 1.89a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.89b:*:*:*:*:*:*:* Versions 1.89b Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.90:*:*:*:*:*:*:* Versions 1.90 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.91:*:*:*:*:*:*:* Versions 1.91 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.92:*:*:*:*:*:*:* Versions 1.92 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.92a:*:*:*:*:*:*:* Versions 1.92a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.92b:*:*:*:*:*:*:* Versions 1.92b Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.92c:*:*:*:*:*:*:* Versions 1.92c Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.93:*:*:*:*:*:*:* Versions 1.93 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.94:*:*:*:*:*:*:* Versions 1.94 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.94a:*:*:*:*:*:*:* Versions 1.94a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.95:*:*:*:*:*:*:* Versions 1.95 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.96:*:*:*:*:*:*:* Versions 1.96 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.96a:*:*:*:*:*:*:* Versions 1.96a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.96b:*:*:*:*:*:*:* Versions 1.96b Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.96c:*:*:*:*:*:*:* Versions 1.96c Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.96d:*:*:*:*:*:*:* Versions 1.96d Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.97:*:*:*:*:*:*:* Versions 1.97 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.97a:*:*:*:*:*:*:* Versions 1.97a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.97b:*:*:*:*:*:*:* Versions 1.97b Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.98:*:*:*:*:*:*:* Versions 1.98 Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.98:a:*:*:*:*:*:* Versions 1.98 a Vulnerable ·Ffftp
  • cpe:2.3:a:ffftp:ffftp:1.98:b:*:*:*:*:*:* Versions 1.98 b Vulnerable ·Ffftp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-4266
  2. 2026-10-03 Alias added: GHSA-r7xc-f7xc-395f

References

Advisory 2

Other 1

  • TI-2011-03531 Untrusted search path vulnerability in FFFTP 1.98a and earlier allows local users to… CVSS 2.0HIGH 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences