CVE-2026-8328: FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
Vulnerability summary
CVE-2026-8328 is a medium (CVSS 5.9) Server-Side Request Forgery vulnerability in python software foundation cpython. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.7% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 35 · Related 31Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST5.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Decrease -0.23 pp
From 0.68% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10< 3.10.12-1~22.04.16
- python3.11All versions (No fix recorded)
- python3.12< 3.12.3-1ubuntu0.15
- python3.13All versions (No fix recorded)
Chainguard5 products
- python-3.10< 3.10.20-r7
- python-3.11< 3.11.15-r5
- python-3.12< 3.12.13-r6
- python-3.13< 3.13.13-r6
- python-3.14< 3.14.5-r1
Wolfi5 products
- python-3.10< 3.10.20-r7
- python-3.11< 3.11.15-r5
- python-3.12< 3.12.13-r6
- python-3.13< 3.13.13-r6
- python-3.14< 3.14.5-r1
Debian4 products
- pypy3All versions (No fix recorded) | < 8.0.0+dfsg-1
- python3.11< 3.11.2-6+deb12u9
- python3.13< 3.13.14-1 | < 3.13.5-2+deb13u3
- python3.14< 3.14.6-1
Alpine1 product
- python3< 3.14.7-r0
Python software foundation1 product
- cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.14 | ≥ 3.14.0, < 3.14.6 | ≥ 3.15.0a1, < 3.15.0b2
6 vendors · 28 products
References
18 links- mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/Vendor AdvisoryREPORTAdvisory
Show all 18 references
- github.com/python/cpythonPACKAGE