CVE-2008-7016: Luke Mewburn Tnftpd

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server.

Affected products

• Luke Mewburn Tnftpd: version 20040810 only; version 20061217 only; version 20080609 only

Published 2009-08-21. Last modified 2026-06-16.