# CVE-2026-67193: Xlight FTP Server information disclosure in USER command

Source: https://junglewise.ai/threats/cve-2026-67193-xlight-ftp-server-information-disclosure-in-user-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-67193 · Severity: medium · CVSS 5.3 · Published 2026-07-29

Xlight FTP Server, a high-performance file transfer server, is vulnerable to an information disclosure flaw. An unauthenticated attacker can remotely obtain internal system timing information by sending a specially crafted username. This data can be used to facilitate more complex attacks against the server's security mechanisms.

## Quick answers

**Is CVE-2026-67193 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67193 being exploited in the wild.

**How severe is CVE-2026-67193?** Medium severity, with a CVSS score of 5.3, published 29 July 2026.

**Which products and versions are affected?** Xlight Xlight FTP Server before 3.9.5.

**Is there a fix for CVE-2026-67193?** A patch was published on 2026-07-01: Version 3.9.5 released fixing security vulnerabilities Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67193 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-67193?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Xlight FTP Server before version 3.9.5 is vulnerable to an observable discrepancy (CWE-203) during the authentication phase. By sending a FTP 'USER' command with a username ending in the ':adm' suffix, an unauthenticated remote attacker can trigger an internal administrative protocol path. This causes the server to leak its current 'GetTickCount()' value within the standard FTP 331 response. This timing information disclosure occurs on the standard FTP listener without requiring access to a separate administrative port or specific configuration changes. The vulnerability was patched in version 3.9.5.

## Affected products

- Xlight Xlight FTP Server before 3.9.5

## Timeline

- 2026-07-01: patched: Version 3.9.5 released fixing security vulnerabilities
- 2026-07-29: disclosed: CVE-2026-67193 published

## References

- [https://www.vulncheck.com/advisories/xlight-ftp-server-information-disclosure-via-user-command](https://www.vulncheck.com/advisories/xlight-ftp-server-information-disclosure-via-user-command)
- [https://www.xlightftpd.com/whatsnew.htm](https://www.xlightftpd.com/whatsnew.htm)