Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-13 | 1 | Patch1 |
| 2026-05-14 | 1 | Disclosure1 |
| 2026-05-15 | 1 | Disclosure1 |
CVE-2026-8328: CPython: FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address https://www.openwall.com/lists/oss-security/2026/05/14/1
Post summary
A new CPython vulnerability (CVE‑2026‑8328) is disclosed, where the FTP PASV command enables SSRF because the client trusts the server‑supplied host address and ignores the actual peer address.
CVE-2026-8328 Unpatched PASV Host Address Validation in Python ftplib ftpcp() Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8328
Post summary
The entry announces CVE-2026-8328, describing a missing PASV host address validation in Python's ftplib ftpcp() function, without providing PoC, exploit code, or patch information.
CVE-2026-8328 The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with t… https://www.cve.org/CVERecord?id=CVE-2026-8328
Post summary
The post highlights that CVE-2026-8328 stems from an unfinished update to ftpcp() after CVE-2021-4189 was patched, noting that makepasv() has been fixed while ftpcp() remains unchanged.