Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an…
Priority LOW 38CWE-276Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.
Why it matters now
EPSS 0.01204 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cerberusftp:ftp_server:*:*:*:*:enterprise:*:*:* | 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.3 | Vulnerable | Cerberusftp |
- cpe:2.3:a:cerberusftp:ftp_server:*:*:*:*:enterprise:*:*:* Versions 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.3 Vulnerable ·Cerberusftp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5196
- 2026-10-03 Alias added: GHSA-9v5j-4424-9fr7
References
More Cerberusftp Ftp Server vulnerabilities
- TI-2026-05493 Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2 CVSS 4.0HIGH 7.3
- TI-2017-04187 In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to… CVSS 3.0HIGH 7.5
- TI-2012-02602 Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in… CVSS 2.0MEDIUM 6.8
- TI-2019-15186 The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document. CVSS 3.1MEDIUM 6.1
- TI-2020-04254 Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and… CVSS 3.1MEDIUM 6.1
- TI-2020-04253 The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2020-5196 · CVE Program
- CVE-2020-5196 · NVD
- FIRST EPSS
- GHSA-9v5j-4424-9fr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences