CVE-2006-7094: Ftpd

High severity, CVSS 8.5. EPSS: 2.6% chance of exploitation in the next 30 days.

ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors.

Affected products

• Ftpd Ftpd: any version

Published 2007-03-02. Last modified 2026-06-16.