Lachlan. H has reported a vulnerability in Golden FTP Server Pro, which can be exploited by malicious users to access arbitrary files on a vulnerable system.

The vulnerability is caused due to an input validation error making it possible to escape the FTP root and retrieve or place arbitrary files on the system via directory traversal attacks using the "\.." character sequence.

It is also possible to disclose the absolute path of the FTP root by attempting to retrieve a non-existent file.

The vulnerability has been reported in version 2.52. Other versions may also be affected.

Solution
Update to version 2.60.

Provided and/or discovered by
Lachlan. H

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area