CVE-2007-5201: Duplicity Project Duplicity

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.

Affected products

• Duplicity Project Duplicity: before 0.4.9 (fixed in 0.4.9)

Published 2007-10-04. Last modified 2026-06-16.