CVE-2020-5196

Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.

• CWE-276

• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-AnnouncementsRelease Notes, Vendor Advisory
• https://www.cerberusftp.com/zip-unzip-permission-bypass-vulnerability-fixed-in-cerberus-ftp-server-versions-11-0-3-and-10-0-18/Vendor Advisory
• https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilitiesExploit, Third Party Advisory
• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-AnnouncementsRelease Notes, Vendor Advisory
• https://www.cerberusftp.com/zip-unzip-permission-bypass-vulnerability-fixed-in-cerberus-ftp-server-versions-11-0-3-and-10-0-18/Vendor Advisory
• https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilitiesExploit, Third Party Advisory

Published

Jan 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5188DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permiss…6.5
• CVE-2020-5191PHPGurukul Hospital Management System in PHP v4.0 suffers fr…6.1
• CVE-2020-5192PHPGurukul Hospital Management System in PHP v4.0 suffers fr…8.8
• CVE-2020-5193PHPGurukul Hospital Management System in PHP v4.0 suffers fr…6.1
• CVE-2020-5194The zip API endpoint in Cerberus FTP Server 8 allows an auth…5.4
• CVE-2020-5195Reflected XSS through an IMG element in Cerberus FTP Server …6.1
• CVE-2020-5197An issue was discovered in GitLab Community Edition (CE) and…4.3
• CVE-2020-5200Minerbabe through V4.16 ships with SSH host keys baked into …5.9
• CVE-2020-5202apt-cacher-ng through 3.3 allows local users to obtain sensi…5.5
• CVE-2020-5203In Fat-Free Framework 3.7.1, attackers can achieve arbitrary…9.8
• CVE-2020-5204In uftpd before 2.11, there is a buffer overflow vulnerabili…8.8
• CVE-2020-5205In Pow (Hex package) before 1.0.16, the use of Plug.Session …5.4