CVE-2011-4266: Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Troja...

Security readout for executives and security teams

FFFTP before 1.98d could run an unintended executable when a user tried to open an extensionless file. In business terms, a local attacker who can place a malicious file where a victim browses could potentially gain that user's privileges. The sources do not provide a CVSS score or evidence of active exploitation. Exposure appears limited to systems running FFFTP before 1.98d, especially where local users can write files into directories later accessed by another user. The bundle's structured affected-product fields are incomplete, so validate against installed software inventory and vendor/JVN records. Treat as a targeted endpoint hardening issue rather than an internet-wide emergency. Prioritize remediation where FFFTP remains on shared workstations, administrator machines, or environments with multiple local users. Lack of CVSS and KEV evidence lowers urgency, but privilege gain keeps it relevant. Mitigation focus: Upgrade FFFTP to version 1.98d or later where still installed.; Remove FFFTP from systems where it is no longer required.; Restrict write access to shared directories used by privileged users..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.