ByteOS Network

CVE Vulnerability Details :

CVE-2026-8328

PUBLISHED

More Info Official Page

Assigner-PSF

Assigner Org ID-28c92f92-d60d-412d-b760-e73465c3df22

Published At-13 May, 2026 | 20:14

Updated At-30 Jun, 2026 | 15:09

▼CVE Numbering Authority (CNA)

FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

Affected Products

Vendor

Python Software Foundation

Product

CPython

Repo

https://github.com/python/cpython

Modules

ftplib

Default Status

unaffected

Versions

Affected

From 0 before 3.13.14 (python)
From 3.14.0 before 3.14.6 (python)
From 3.15.0a1 before 3.15.0b2 (python)

Problem Types

Type	CWE ID	Description
CWE	CWE-918	CWE-918 Server-Side request forgery (SSRF)

Type: CWE

CWE ID: CWE-918

Description: CWE-918 Server-Side request forgery (SSRF)

Metrics

Version	Base score	Base severity	Vector
4.0	5.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Version: 4.0

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Credits

reporter

Qi Deng (https://github.com/ikow)

remediation developer

Bénédikt Tran (https://github.com/picnixz)

remediation developer

Gregory P. Smith (https://github.com/gpshead)

References

Hyperlink	Resource
https://github.com/python/cpython/issues/87451	issue-tracking
https://github.com/python/cpython/pull/149648	patch
https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/	vendor-advisory
https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06	patch
https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0	patch
https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763	patch
https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d	patch
https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9	patch
https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f	patch
https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb	patch