FileZilla Client Installer uninstall.exe unquoted search path
Priority HIGH 67CWE-428Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-428.
Summary
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00977 62nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FileZilla | Client | 3.17.0.0 | — | No fix listed | CNA |
- Client VendorFileZilla Affected 3.17.0.0 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:filezilla-project:filezilla_client:3.17.0:*:*:*:*:*:*:* | 3.17.0 | Vulnerable | Filezilla-Project |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:filezilla-project:filezilla_client:3.17.0:*:*:*:*:*:*:* Versions 3.17.0 Vulnerable ·Filezilla-Project
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-15003
- 2026-10-03 Alias added: GHSA-7j5p-c5cp-hrh6
References
More FileZilla vulnerabilities
- TI-2005-03407 Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a… CVSS 2.0HIGH 7.8
- TI-2007-02236 Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers… CVSS 2.0HIGH 9.3
- TI-2007-00306 Multiple buffer overflows in FileZilla before 2.2.30a allow remote attackers to execute… CVSS 2.0HIGH 9.3
- TI-2019-03838 Untrusted search path in FileZilla CVSS 3.1HIGH 7.8
- TI-2007-00308 Format string vulnerability in the LogMessage function in FileZilla before 3.0.0-beta5… CVSS 2.0HIGH 7.5
- TI-2006-02339 Buffer overflow in FileZilla before 2.2.23 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
Sources
- CVE-2016-15003 · CVE Program
- CVE-2016-15003 · NVD
- FIRST EPSS
- GHSA-7j5p-c5cp-hrh6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences