Executive brief
A vulnerability exists in the Python standard library's FTP module, which is used by developers to transfer files between servers. A malicious FTP server could trick a client into connecting to a different, unintended computer or service on the network. This could be used to bypass network security controls or perform unauthorized actions on internal systems.
Technical details
The ftpcp() function in Lib/ftplib.py was found to be vulnerable to Server-Side Request Forgery (SSRF) because it calls parse227() directly and trusts the IP address provided by the source FTP server in response to a PASV command. This bypasses a previous fix (CVE-2021-4189) that was applied to the makepasv() function but missed in ftpcp(). An attacker controlling a malicious source FTP server can provide an arbitrary IP address and port, which the client then passes to the target server's PORT command, causing the target server to initiate a data connection to the attacker's chosen destination. The fix ensures ftpcp() uses the source server's actual peer address instead of the self-reported address.
Affected products
- Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15
Timeline
- 2026-05-10: patched: Initial fix committed to CPython repository.
- 2026-05-13: disclosed: CVE-2026-8328 published.
References
- https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06
- https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0
- https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763
- https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d
- https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
- https://github.com/python/cpython/issues/87451
- https://github.com/python/cpython/pull/149648