CVE-2025-34110: Coloradoftp Server

Critical severity, CVSS 9.3. EPSS: 1.9% chance of exploitation in the next 30 days.

A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.

Affected products

• Coloradoftp Server: up to and including 1.3 Build 8

Published 2025-07-15. Last modified 2026-06-17.