Secunia

Two vulnerabilities have been identified in Xlight FTP Server, which can be exploited by malicious, authenticated users to read arbitrary files on a vulnerable system or cause a DoS (Denial of Service).

Arbitrary files outside the ftp root can be retrieved by conducting a directory traversal attack.

The service can be crashed by supplying a "~" character as argument to the "cd" command.

The vulnerabilities have been reported in version 1.40. Other versions may also be affected.

Solution
Update to version 1.41.
Further details available in Customer Area

Provided and/or discovered by
Ziv Kamir

Deep Links
Links available in Customer Area