CVE-2011-4266: Ffftp

High severity, CVSS 9.3. EPSS: 1.8% chance of exploitation in the next 30 days.

Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file, a different vulnerability than CVE-2011-3991.

Affected products

• Ffftp Ffftp: up to and including 1.98; version 1.79a only; version 1.80 only; version 1.81 only; version 1.82 only; version 1.83 only; …

Published 2011-12-13. Last modified 2026-06-16.