CVE-2020-5194: Cerberusftp FTP Server

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajax_download_zip/zip_name endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists.

Affected products

• Cerberusftp FTP Server: version 8.0 only

Published 2020-01-14. Last modified 2026-06-17.