CVE-2019-25683
Denial of Service in FileZilla 3.40.0 Local Search
Publication date: 2026-04-05
Last updated on: 2026-04-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filezilla-project | filezilla_client | 3.40.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FileZilla version 3.40.0 and is a denial of service issue within the local search functionality.
Local attackers can cause the application to crash by providing a specially crafted malformed path string.
Specifically, the attacker inputs a path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences into the search directory field and initiates a local search, which triggers the crash.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service condition.
An attacker with local access can crash the FileZilla application, causing disruption of service.
This could lead to loss of availability of the application until it is restarted or the issue is resolved.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is triggered by a local attacker supplying a malformed path string in the local search functionality of FileZilla 3.40.0. Detection involves checking if the application crashes when a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences is entered in the search directory field and a local search is initiated.
Since this is a local denial of service vulnerability, network detection commands are not applicable. Detection should be performed by attempting the described malformed input in a controlled environment to observe if the application crashes.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the local search functionality in FileZilla 3.40.0 until a patch or update is available that addresses this vulnerability.
Additionally, restrict local user access to the FileZilla application to trusted users only, minimizing the risk of exploitation by local attackers.