CVE-2007-2348: mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote...

Security readout for executives and security teams

CVE-2007-2348 affects lftp before 3.5.9. A generated mirror script may fail to quote shell metacharacters safely, so a user who runs a malicious script could execute unintended shell commands. The source record notes uncertainty about whether this crosses a security boundary. Exposure is most likely where legacy lftp versions are installed and mirror --script output is generated or run against untrusted remote content. Modern systems using vendor-patched packages are less likely to be exposed, but this must be verified locally. Treat as a legacy exposure cleanup item unless lftp mirror automation handles untrusted sources. The business urgency rises if old servers still run lftp scripts in production workflows. Mitigation focus: Upgrade lftp to 3.5.9 or a vendor-supported patched package.; Check Red Hat, Gentoo, rPath, or distribution guidance for applicable fixes.; Avoid running mirror --script output from untrusted remote sources..

Prepared

Jun 29, 2026, 05:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.