CVE-2026-8328 — FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

Back Back to CVE browser

MEDIUM

FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

Published May 13, 2026

5.9

MEDIUM

CVSS 4.0

EPSS 0.68%

Description

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

Affected products

Vendor Python Software Foundation Product CPython Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.10.21
- Version
  3.11.0
  Status
  affected
  Constraints
  <3.11.16
- Version
  3.12.0
  Status
  affected
  Constraints
  <3.12.14
- Version
  3.13.0
  Status
  affected
  Constraints
  <3.13.14
- Version
  3.14.0
  Status
  affected
  Constraints
  <3.14.6
- Version
  3.15.0a1
  Status
  affected
  Constraints
  <3.15.0b2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Python Software Foundation

CPython

unaffected

Version	Status	Constraints
0	affected	<3.10.21
3.11.0	affected	<3.11.16
3.12.0	affected	<3.12.14
3.13.0	affected	<3.13.14
3.14.0	affected	<3.14.6
3.15.0a1	affected	<3.15.0b2

Red Hat Hardened Images

python3-10-main-3.10.21-1.3.hum1

Fixed · RHSA-2026:68132
Red Hat Hardened Images

python3-11-main-3.11.16-1.4.hum1

Fixed · RHSA-2026:68135
Red Hat Hardened Images

python3-12-main-3.12.14-1.3.hum1

Fixed · RHSA-2026:68154
Red Hat Hardened Images

python3-13-main-3.13.15-1.3.hum1

Fixed · RHSA-2026:68309
Red Hat Hardened Images

python3-14-main-3.14.7-1.2.hum1

Fixed · RHSA-2026:67572
Red Hat Hardened Images

hi/python

Not affected

Product	Package	State	Advisory
Red Hat Hardened Images	python3-10-main-3.10.21-1.3.hum1	Fixed	RHSA-2026:68132
Red Hat Hardened Images	python3-11-main-3.11.16-1.4.hum1	Fixed	RHSA-2026:68135
Red Hat Hardened Images	python3-12-main-3.12.14-1.3.hum1	Fixed	RHSA-2026:68154
Red Hat Hardened Images	python3-13-main-3.13.15-1.3.hum1	Fixed	RHSA-2026:68309
Red Hat Hardened Images	python3-14-main-3.14.7-1.2.hum1	Fixed	RHSA-2026:67572
Red Hat Hardened Images	hi/python	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.68% 0.00683

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00683

Score over time

May–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.68% (0.00683)	50.77th	v5 (v2026.06.15)
Jun 15, 2026	0.40% (0.00401)	31.66th	v5 (v2026.06.15)
May 14, 2026	0.04% (0.00039)	11.65th	v4 (v2025.03.14)

Weaknesses (2)

CWE-807

CWE-918

SSRF

References (14)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-8328		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2477300		Issue Tracking
https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f		patch
https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06		patch
https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0		patch
https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763		patch
https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d		patch
https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9		patch
https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb		patch
https://github.com/python/cpython/issues/87451		issue-tracking
https://github.com/python/cpython/pull/149648		patch
https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8328
https://www.cve.org/CVERecord?id=CVE-2026-8328