CVE-2026-8328
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplie
CVSS
—
No CVSS
EPSS
0.5%
p38
KEV
—
Exploit Today
11
0-100
Published: May 13, 2026 · Last modified: Jun 30, 2026 · CWE-918
0.4%EPSS · 30 days0.5%
2026-06-302026-07-17
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
- github.comhttps://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f
- github.comhttps://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06
- github.comhttps://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0
- github.comhttps://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763
- github.comhttps://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d
- github.comhttps://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
- github.comhttps://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb
- github.comhttps://github.com/python/cpython/issues/87451
- github.comhttps://github.com/python/cpython/pull/149648
- mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-202308.6 HIG98.5%
KEV—80Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability17dCVE-2026-1540910.0 CRI66.5%
KEV—70SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability2dCVE-2020-248819.8 CRI99.4%
——30SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.8dCVE-2026-445788.6 HIG98.4%
——30Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.2dCVE-2023-271597.5 HIG98.3%
——29Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.10dCVE-2026-483327.7 HIG95.7%
——29ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.3d