CVE-2015-7601: PCMan FTP Server directory traversal in RETR command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote file reads, has a public exploit, and carries a very high EPSS score, though it is not listed in KEV and requires the FTP service to be exposed.

What it is

PCMan's FTP Server 2.0.7 contains a directory traversal flaw in its handling of the RETR command. A remote attacker can supply a ..// sequence to escape the intended directory and read arbitrary files on the host. Because the server is an FTP service, the flaw exposes file contents to anyone who can reach the port.

Impact

An attacker gains read access to files outside the FTP root, including any file readable by the FTP server process. This can leak configuration, credential or system files, though the flaw does not permit writing or code execution on its own.

Attack surface

The vulnerability is reached over the network through the FTP RETR command; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing the affected FTP service is directly reachable.

Exploitation

No CISA KEV listing is present, but a public Exploit-DB entry exists and EPSS reports a 30-day probability of roughly 0.58 (99th percentile), indicating high likelihood of attempted exploitation.

What to do

• Upgrade or replace PCMan's FTP Server 2.0.7 with a maintained FTP server that is not affected by this traversal flaw.
• If the product cannot be replaced, restrict FTP access to trusted networks and disable anonymous or unauthenticated access.
• Run the FTP service under a low-privilege account with access limited to the intended FTP root.
• Block or normalize ..// and similar traversal sequences at the FTP command layer if a supported configuration option exists.
• Monitor vendor channels for an official fix, since no patch detail is provided in this record.

Detection

• Inspect FTP server logs for RETR commands containing ..// or other dot-dot traversal patterns.
• Alert on file-read activity outside the configured FTP root by the FTP service account.
• Monitor network traffic on the FTP control channel for anomalous RETR paths.
• Correlate repeated failed or unusual RETR requests from a single source with scanning activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.