Description
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lftp | 4.0.6-1 | — |
| Debian 13 | lftp | 4.0.6-1 | — |
| Debian 12 | lftp | 4.0.6-1 | — |
| Debian 5.0 | lftp | 3.7.3-1+lenny1 | DSA-2085-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | lftp | 3.7.11-4.el5_5.3 | RHSA-2010:0585 |
Advisories 2
- RHSA-2010:0585 Red Hat Security Advisory: lftp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2085-1 lftp - file overwrite vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20100517 [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- http://wiki.rpath.com/Advisories:rPSA-2010-0073
- https://bugzilla.redhat.com/show_bug.cgi?id=602836
- ADV-2010-1654 vdb-entry
- [oss-security] 20100609 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- FEDORA-2010-9819 vendor-advisory
- http://www.ocert.org/advisories/ocert-2010-001.html
- https://bugzilla.redhat.com/show_bug.cgi?id=591580
- SUSE-SR:2010:014 vendor-advisory
- 40400 third-party-advisory
- DSA-2085 vendor-advisory
- 20101027 rPSA-2010-0073-1 lftp mailing-list
- http://lftp.yar.ru/news.html
- [oss-security] 20100520 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100610 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list