---
id: CVE-2010-20103
title: >-
  A malicious backdoor was embedded in the official ProFTPD 1.3.3c source
  tarball distributed between November 28 and December 2, 2010
summary: >-
  A malicious backdoor was embedded in the official ProFTPD 1.3.3c source
  tarball distributed between November 28 and December 2, 2010. The backdoor
  implements a hidden FTP command trigger that, when invoked, causes the server
  to execute a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-912
vendor: proftpd
product: proftpd
affected:
  - proftpd = 1.3.3
published: '2025-08-20'
updated: '2026-07-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2010-20103'
references:
  - url: 'http://www.proftpd.org/'
    label: disclosure@vulncheck.com
  - url: >-
      https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/
    label: disclosure@vulncheck.com
  - url: 'https://github.com/proftpd/proftpd'
    label: disclosure@vulncheck.com
  - url: >-
      https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb
    label: disclosure@vulncheck.com
  - url: 'https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/'
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/15662'
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/16921'
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/advisories/proftpd-backdoor-command-execution'
    label: disclosure@vulncheck.com
  - url: >-
      https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://www.exploit-db.com/exploits/15662'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://www.exploit-db.com/exploits/16921'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.0509
epssPercentile: 0.92002
ingestedAt: '2026-07-15T13:44:02.924Z'
exploits:
  metasploit:
    - exploit/unix/ftp/proftpd_133c_backdoor
  nuclei:
    - javascript/cves/2010/CVE-2010-20103
  checkedAt: '2026-09-21T15:26:54.520Z'
exploitAvailable: true
---

## Overview

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

## Affected

- `proftpd = 1.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.