CVE-2011-1575: Pureftpd Pure-Ftpd

Medium severity, CVSS 5.8. EPSS: 33.3% chance of exploitation in the next 30 days.

The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

Affected products

• Pureftpd Pure-Ftpd: up to and including 1.0.29; version 0.90 only; version 0.91 only; version 0.92 only; version 0.93 only; version 0.94 only; …

Published 2011-05-23. Last modified 2026-06-16.