CVE-2021-3331: Winscp

Critical severity, CVSS 9.8. EPSS: 7.6% chance of exploitation in the next 30 days.

WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)

Affected products

• Winscp Winscp: before 5.17.10 (fixed in 5.17.10)

Published 2021-01-27. Last modified 2026-10-08.