Executive brief
Xlight FTP Server, a high-performance file transfer solution, is vulnerable to a critical security flaw in its SSH/SFTP component. An unauthenticated attacker can exploit this to take full control of the server or disrupt its operations before a user even logs in. This could lead to the theft of sensitive files, data corruption, or a complete shutdown of the file transfer service.
Technical details
A stack-based buffer overflow (CWE-121) exists in Xlight FTP Server versions prior to 3.9.5. The vulnerability is triggered during the SSH handshake when a GCM cipher is negotiated. An attacker can send a malformed SSH packet containing an unvalidated length field that is passed directly to the GCM decryption function. This allows the attacker to overwrite the stack cookie and return address, potentially leading to remote code execution (RCE) in a pre-authentication context. The vendor has addressed this in version 3.9.5.
Affected products
- Xlight Xlight FTP Server before 3.9.5
Timeline
- 2026-07-01: patched: Version 3.9.5 released fixing security vulnerabilities
- 2026-07-29: disclosed: Public disclosure of CVE-2026-67192