CVE-2025-34110
CRITICALColoradoFTP Server < 1.3 Build 8 - Path Traversal
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-34110.
PoCs published by Rv3Laboratory, h00die <[email protected]>, RvLaboratory, including Metasploit module auxiliary/scanner/ftp/colorado_ftp_traversal.
AI-analyzed exploit summary This is a detailed vulnerability writeup describing a directory traversal flaw in ColoradoFTP v1.3 Prime Edition (Build 8). The advisory includes proof-of-concept commands demonstrating how an attacker can traverse directories and upload/download files outside the intended directory structure.
Description
A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.
Exploits (2)
This is a detailed vulnerability writeup describing a directory traversal flaw in ColoradoFTP v1.3 Prime Edition (Build 8). The advisory includes proof-of-concept commands demonstrating how an attacker can traverse directories and upload/download files outside the intended directory structure.
This Metasploit module exploits a directory traversal vulnerability in ColoradoFTP Server 1.3 Build 8, allowing arbitrary file download via crafted GET commands with traversal strings. It includes authentication and file retrieval logic.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N