RUSTSEC-2026-0271

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0271

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0271.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0271

Aliases

GHSA-8mhj-xm4h-m5m6

Published

2026-08-18T12:00:00Z

Modified

2026-08-31T09:30:02Z

Summary

FTP command injection via CRLF in control channel arguments

Details

Affected versions of suppaftp wrote command arguments (user name, password, paths, SITE arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (\r) or a line feed (\n) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.

An application that passes untrusted input as credentials, paths or command strings to methods such as login, cwd, mkdir, rmdir, rm, rename, retr, put_file, site or custom_command can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected PORT.

All three clients are affected: sync, tokio and smol, with or without TLS.

The flaw was corrected in version 10.0.2 (commit 194bdd1): every command line is validated before it is written to the wire and rejected with FtpError::ConnectionError (std::io::ErrorKind::InvalidInput) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, custom_command no longer accepts several commands joined by CRLF in a single call.

Users who cannot upgrade should reject or strip \r and \n from any untrusted string before passing it to the client.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / suppaftp

Package

Name: suppaftp; View open source insights on deps.dev
Purl: pkg:cargo/suppaftp

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

10.0.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "suppaftp::ImplFtpStream::custom_command",
            "suppaftp::ImplFtpStream::cwd",
            "suppaftp::ImplFtpStream::login",
            "suppaftp::ImplFtpStream::mkdir",
            "suppaftp::ImplFtpStream::put_file",
            "suppaftp::ImplFtpStream::rename",
            "suppaftp::ImplFtpStream::retr",
            "suppaftp::ImplFtpStream::rm",
            "suppaftp::ImplFtpStream::rmdir",
            "suppaftp::ImplFtpStream::site",
            "suppaftp::smol::ImplAsyncFtpStream::custom_command",
            "suppaftp::smol::ImplAsyncFtpStream::cwd",
            "suppaftp::smol::ImplAsyncFtpStream::login",
            "suppaftp::smol::ImplAsyncFtpStream::mkdir",
            "suppaftp::smol::ImplAsyncFtpStream::put_file",
            "suppaftp::smol::ImplAsyncFtpStream::rename",
            "suppaftp::smol::ImplAsyncFtpStream::retr",
            "suppaftp::smol::ImplAsyncFtpStream::rm",
            "suppaftp::smol::ImplAsyncFtpStream::rmdir",
            "suppaftp::smol::ImplAsyncFtpStream::site",
            "suppaftp::tokio::ImplAsyncFtpStream::custom_command",
            "suppaftp::tokio::ImplAsyncFtpStream::cwd",
            "suppaftp::tokio::ImplAsyncFtpStream::login",
            "suppaftp::tokio::ImplAsyncFtpStream::mkdir",
            "suppaftp::tokio::ImplAsyncFtpStream::put_file",
            "suppaftp::tokio::ImplAsyncFtpStream::rename",
            "suppaftp::tokio::ImplAsyncFtpStream::retr",
            "suppaftp::tokio::ImplAsyncFtpStream::rm",
            "suppaftp::tokio::ImplAsyncFtpStream::rmdir",
            "suppaftp::tokio::ImplAsyncFtpStream::site"
        ],
        "os": []
    }
}