{"id":"RUSTSEC-2026-0271","aliases":["GHSA-8mhj-xm4h-m5m6"],"title":"FTP command injection via CRLF in control channel arguments","summary":"FTP command injection via CRLF in control channel arguments","severity":"none","vendor":"suppaftp","product":"suppaftp","ecosystem":"rust","affected":["suppaftp >= 0.0.0-0, < 10.0.2"],"patched":["suppaftp 10.0.2"],"published":"2026-08-18","updated":"2026-08-31","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0271","references":[{"url":"https://crates.io/crates/suppaftp"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0271.html"},{"url":"https://github.com/veeso/suppaftp/pull/172"}],"tags":["osv","rust"],"ingestedAt":"2026-08-31T19:30:40.303Z","slug":"RUSTSEC-2026-0271","body":"## Overview\n\nAffected versions of `suppaftp` wrote command arguments (user name, password, paths, `SITE` arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (`\\r`) or a line feed (`\\n`) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.\n\nAn application that passes untrusted input as credentials, paths or command strings to methods such as `login`, `cwd`, `mkdir`, `rmdir`, `rm`, `rename`, `retr`, `put_file`, `site` or `custom_command` can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected `PORT`.\n\nAll three clients are affected: sync, tokio and smol, with or without TLS.\n\nThe flaw was corrected in version 10.0.2 (commit [194bdd1](https://github.com/veeso/suppaftp/commit/194bdd1979b16c4848d1fad6897dfa524b688d88)): every command line is validated before it is written to the wire and rejected with `FtpError::ConnectionError` (`std::io::ErrorKind::InvalidInput`) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, `custom_command` no longer accepts several commands joined by CRLF in a single call.\n\nUsers who cannot upgrade should reject or strip `\\r` and `\\n` from any untrusted string before passing it to the client.\n\n## Affected packages\n\n- `suppaftp >= 0.0.0-0, < 10.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `suppaftp 10.0.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}