CVE-2020-20277

There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.

• CWE-22

• http://packetstormsecurity.com/files/167908/uftpd-2.10-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://arinerron.com/blog/posts/6Third Party Advisory
• https://github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fePatch, Third Party Advisory
• http://packetstormsecurity.com/files/167908/uftpd-2.10-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://arinerron.com/blog/posts/6Third Party Advisory
• https://github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fePatch, Third Party Advisory

Published

Dec 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-20265Mikrotik RouterOs before 6.47 (stable tree) suffers from a m…6.5
• CVE-2020-20266Mikrotik RouterOs before 6.47 (stable tree) suffers from a m…6.5
• CVE-2020-20267Mikrotik RouterOs before 6.47 (stable tree) suffers from a m…6.5
• CVE-2020-20269A specially crafted Markdown document could cause the execut…9.8
• CVE-2020-2027A buffer overflow vulnerability in the authd component of th…7.2
• CVE-2020-20276An unauthenticated stack-based buffer overflow vulnerability…9.8
• CVE-2020-2028An OS Command Injection vulnerability in PAN-OS management s…7.2
• CVE-2020-20285There is a XSS in the user login page in zzcms 2019. Users c…5.4
• CVE-2020-20287Unrestricted file upload vulnerability in the yccms 3.3 proj…9.8
• CVE-2020-20289Sql injection vulnerability in the yccms 3.3 project. The no…9.8
• CVE-2020-2029An OS Command Injection vulnerability in the PAN-OS web mana…7.2
• CVE-2020-20290Directory traversal vulnerability in the yccms 3.3 project. …7.5