CVE-2020-14149: Troglobit Uftpd

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command.

Affected products

• Troglobit Uftpd: before 2.12 (fixed in 2.12)

Published 2020-06-15. Last modified 2026-06-17.