CVE-2017-15270

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) file. This can be used by attackers to hide data in the Graphical User Interface (GUI) view and create arbitrary entries to a certain extent. Special characters such as '"' and ',' and '\r' are not escaped and can be used to add new entries to the log.

• CWE-20

• http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/541518/100/0/threaded
• https://www.exploit-db.com/exploits/43144/Third Party Advisory, VDB Entry
• https://www.x41-dsec.de/lab/advisories/x41-2017-006-psftpd/Third Party Advisory
• http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/541518/100/0/threaded
• https://www.exploit-db.com/exploits/43144/Third Party Advisory, VDB Entry
• https://www.x41-dsec.de/lab/advisories/x41-2017-006-psftpd/Third Party Advisory

Published

Nov 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15265Race condition in the ALSA subsystem in the Linux kernel bef…7
• CVE-2017-15266In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRAC…
• CVE-2017-15267In GNU Libextractor 1.4, there is a NULL Pointer Dereference…
• CVE-2017-15268Qemu through 2.10.0 allows remote attackers to cause a memor…
• CVE-2017-15269The PSFTPd 10.0.4 Build 729 server does not prevent FTP boun…
• CVE-2017-1527IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable…
• CVE-2017-15271A use-after-free issue could be triggered remotely in the SF…
• CVE-2017-15272The PSFTPd 10.0.4 Build 729 server stores its configuration …
• CVE-2017-15273Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 be…
• CVE-2017-15274security/keys/keyctl.c in the Linux kernel before 4.11.5 doe…
• CVE-2017-15275Samba before 4.7.3 might allow remote attackers to obtain se…7.5
• CVE-2017-15276OpenText Documentum Content Server (formerly EMC Documentum …