CVE-2018-10916: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 4.8% chance of exploitation in the next 30 days.

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.

Affected products

• Canonical Ubuntu Linux: version 12.04 only
• Lftp Project Lftp: up to and including 4.8.3
• Opensuse Leap: version 42.3 only

Published 2018-08-01. Last modified 2026-06-17.