Debian/lftp: unknown

mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not cl

Action: Upgrade lftp to 3.5.9-1 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2007-2348#Debian:14/lftp
• https://security-tracker.debian.org/tracker/CVE-2007-2348

published 2007-04-27T18:19:00Z · modified 2026-10-21T17:47:47.557003641Z · JSON