PatchTheCVECVE-2018-10916: It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file name
CVE-2018-10916 is a medium-severity flaw (CVSS 5.3) affecting lftp, ubuntu linux, leap. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
Why this priority
- EPSS top 8%: very likely to be exploited
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 4.8% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-20 |
| Published | 2018-08-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-10916?
lftp: upgrade to newer than 4.8.3; ubuntu linux: mitigate or apply the listed mitigation; leap: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-10916 being exploited?
CVE-2018-10916 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-10916 affect?
CVE-2018-10916 affects lftp, ubuntu linux, leap. Severity is medium (CVSS 5.3). It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use re
How urgent is CVE-2018-10916?
Priority 52/100. EPSS top 8%: very likely to be exploited; Public exploit reference; On your watchlist