Executive brief
FileZilla is a widely used application for transferring files between computers and servers. A flaw in the software's local file search feature allows a user on the same computer to crash the application by entering a specially formatted, overly long file path. While this does not allow for data theft, it can disrupt file transfer operations and cause the software to become unavailable until restarted.
Technical details
A denial of service vulnerability exists in FileZilla 3.40.0 within the 'Local search' and 'Local site' components. The issue is triggered when the application processes a malformed directory path string, specifically one exceeding 384 characters in length followed by specific byte sequences. An attacker with local access can trigger an application crash by pasting this crafted string into the 'Search directory' or 'Local site' fields and initiating an operation. This appears to be a memory corruption issue, likely a buffer overflow, though the primary impact is application instability. Proof-of-concept exploits have been publicly disclosed.
Affected products
- FileZilla Project FileZilla Client 3.40.0
Timeline
- 2019-02-20: disclosed: Initial discovery by researcher Mr Winst0n
- 2019-03-04: other: Public exploit code released on Exploit-DB
- 2026-04-05: advisory: NVD/VulnCheck advisory published