CVE-2022-2560: CompleteFTP Server unauthenticated path traversal allows arbitrary file deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated remote arbitrary file deletion as SYSTEM with a CVSS of 9.1 and very high EPSS makes this an urgent exposure for any internet-facing CompleteFTP instance.

What it is

EnterpriseDT CompleteFTP 22.1.0 Server fails to validate a user-supplied path in the HttpFile class before using it in file operations, allowing path traversal. A remote attacker with no credentials can delete arbitrary files, and the deletion occurs in the context of SYSTEM. This is a critical integrity and availability issue for any internet-exposed instance.

Impact

An unauthenticated attacker can delete arbitrary files on the server as SYSTEM, which can break the FTP service, destroy configuration or data, and potentially enable further compromise. There is no confidentiality impact per the CVSS vector; the gain is destructive control over the host's filesystem.

Attack surface

Reachable over the network through the HTTP-facing component of CompleteFTP Server, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required, so any exposed instance is directly attackable.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged beyond the ZDI advisory, but EPSS is very high at roughly 0.777 (99.5th percentile), indicating strong predicted likelihood of exploitation. Treat active exploitation as plausible.

What to do

• Upgrade CompleteFTP Server to a version that fixes the HttpFile path validation flaw; confirm the fixed release with EnterpriseDT since the record does not name one.
• If patching is not immediate, remove internet exposure of the CompleteFTP HTTP interface and restrict it to trusted management networks.
• Run the CompleteFTP service under a low-privilege account rather than SYSTEM to limit the impact of file deletion.
• Maintain offline or immutable backups of CompleteFTP configuration and hosted data so deleted files can be restored.
• Monitor vendor advisories and the ZDI reference for updated fixed-version guidance.

Detection

• Alert on HTTP requests to CompleteFTP containing traversal sequences such as ../ or encoded variants in path parameters.
• Monitor for unexpected deletion or disappearance of files under the CompleteFTP installation and data directories.
• Watch for service crashes, restarts, or configuration loss on CompleteFTP hosts that could indicate destructive file operations.
• Correlate CompleteFTP HTTP access logs with file system change events to identify unauthenticated requests preceding deletions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.