An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674.

published 2019-03-22 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-19016

cvss: 5.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 14.5%; EPSS 14.5% chance of exploitation in 30 days, percentile 96%
public exploits: 1; Exploit-DB

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.

Timeline

2019-03-13 First public exploit (EDB-46534)
2019-03-22 Published

Exploit prediction

14.54% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-46534 Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal dos, 2019-03-13
seclists.org https://seclists.org/fulldisclosure/2019/Mar/25 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

exploit-db.com /exploits/46534
exploit, third-party-advisory, vdb-entry
seclists.org /fulldisclosure/2019/Mar/25
mailing-list, exploit, third-party-advisory
coreftp.com /forums/viewtopic.php?f=15&t=4022509
product, vendor-advisory
securityfocus.com /bid/107449
vdb-entry, third-party-advisory
seclists.org /fulldisclosure/2019/Aug/22
mailing-list
packetstormsecurity.com /files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html

Sources

CVE List CVE-2019-9649
NVD CVE-2019-9649

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary