CVE-2026-109681
MEDIUM
NVD
CVSS Score
4.7
Severity
MEDIUM
Published
Oct 21, 2026
Vendor
unknown
Description
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.