← Vulnerability feed

Vulnerability record · CVE-2010-2695 · published 12 July 2010

CVE-2010-2695: Xlightftpd xlight ftp server path traversal vulnerability

Xlightftpd · Xlight Ftp Server

Directory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows remote authenticated users to read, overwrite, or delete arbitrary files via .. (dot dot) sequences in the (1) ls, (2) rm, (3) rename, and other unspecified commands.

6.5 CVSS 2.0 Medium EPSS 1.9% · top 21.4% CWE-22 · Path traversal
6.5CVSS 2.0 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
16 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows remote authenticated users to read, overwrite, or delete arbitrary files via .. (dot dot) sequences in the (1) ls, (2) rm, (3) rename, and other unspecified commands.

AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/66037
http://secunia.com/advisories/40473 Vendor Advisory
http://www.securityfocus.com/archive/1/512192/100/0/threaded
http://www.xlightftpd.com/whatsnew.htm Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/60151
http://osvdb.org/66037
http://secunia.com/advisories/40473 Vendor Advisory
http://www.securityfocus.com/archive/1/512192/100/0/threaded
http://www.xlightftpd.com/whatsnew.htm Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/60151

Track CVE-2010-2695 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2019-25681Xlightftpd xlight ftp server out-of-bounds write vulnerabilityXlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application an…EPSS 0.21%7.5CVE-2024-0737Xlightftpd xlight ftp server improper resource shutdown vulnerabilityA vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Log…EPSS 4.2%6.8CVE-2009-4795Xlightftpd xlight ftp server sql injection vulnerabilityMultiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbi…EPSS 2.0%5.1CVE-2023-53886Xlightftpd xlight ftp server stack-based buffer overflow vulnerabilityXlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the ap…EPSS 0.43%9.8CVE-2026-93616Checkpoint multi-domain security management path traversal vulnerabilityA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Managem…KEVEPSS 20%10.0CVE-2026-85706GitLab CE/EE repository commits API path traversal allows unauthenticated file readGitLab CE/EE contains improper path confinement and missing authentication enforcement in the repository commits API, allowing an unauthenticated use…KEVEPSS 91%analysed5.3CVE-2026-66384JFrog Artifactory path traversal in Docker cache pathAn authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions in JFrog Artifactory. The fla…KEVEPSS 0.66%analysed9.8CVE-2026-59310VMware vCenter Syslog server path traversal leads to RCEVMware vCenter's Syslog server is affected by a directory traversal flaw (CWE-22) that allows a remote, unauthenticated attacker to execute arbitrary…KEVEPSS 2.6%analysed

Source: NIST National Vulnerability Database (record CVE-2010-2695), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.