CVE-2007-2348: Alexander V. Lukyanov Lftp

Medium severity, CVSS 6.8. EPSS: 3.2% chance of exploitation in the next 30 days.

mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.

Affected products

• Alexander V. Lukyanov Lftp: up to and including 3.5.8

Published 2007-04-27. Last modified 2026-06-16.