Security readout for executives and security teams
Plain-English summary
A malicious or compromised FTP server can supply a passive-mode address that Python's ftpcp() trusts. This may cause another FTP endpoint involved in a server-to-server copy to connect to an unintended system, creating a server-side request forgery risk and potential integrity impact.
Executive priority
Prioritize patching systems that automate server-to-server FTP copies across trust boundaries or can reach sensitive internal services. Treat other installations as routine remediation after confirming ftpcp() usage. The medium score and prerequisite conditions reduce broad urgency, but high integrity impact warrants prompt review where exposure exists.
Technical view
CPython Lib/ftplib.py fixed PASV address handling in makepasv() for CVE-2021-4189, but ftpcp() continued calling parse227() directly. It forwards the server-controlled address and port to target.sendport() instead of using the actual peer address. The issue is CWE-918 with CVSS 4.0 score 5.9.
Likely exposure
Exposure requires Python code using ftplib.ftpcp(), passive FTP behavior, and interaction with a malicious or compromised FTP server. Applications that never call ftpcp(), prohibit untrusted FTP endpoints, or tightly restrict outbound connections are less exposed. The supplied affected-version data does not clearly establish exact vulnerable-to-fixed release boundaries.
Exploitation context
The CVE is not listed in CISA KEV, and the supplied sources do not report active exploitation. Exploitation requires application involvement and control over, or compromise of, an FTP server participating in the transfer. Successful abuse could redirect a connection toward an attacker-selected network address.
Researcher notes
This is an incomplete-fix variant related to CVE-2021-4189. The security boundary failure is specifically ftpcp() bypassing corrected makepasv() behavior and trusting parse227() output. Multiple CPython patch commits are supplied, but the bundle does not map each commit to a precise fixed release or document observed exploitation.
Mitigation direction
- Update CPython to a vendor-confirmed patched release applicable to your supported branch.
- Review the Python security advisory and linked commits for branch-specific remediation status.
- Avoid ftplib.ftpcp() with untrusted or externally controlled FTP servers until patched.
- Restrict FTP-server egress to approved destinations as a compensating control.
Validation and detection
- Inventory deployed CPython versions and applications importing or calling ftplib.ftpcp().
- Confirm installed branch patches match the vendor advisory or linked CPython commits.
- Review FTP workflows for connections to untrusted, external, or compromised servers.
- Monitor FTP server connection logs for unexpected destination addresses during server-to-server transfers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-8328 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
5.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/issues/87451CVE reference, PSF · issue-tracking
- https://github.com/python/cpython/pull/149648CVE reference, PSF · patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06CVE reference, PSF · patch
- https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0CVE reference, PSF · patch
- https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763CVE reference, PSF · patch
- https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1dCVE reference, PSF · patch
- https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9CVE reference, PSF · patch
- https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5fCVE reference, PSF · patch
- https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fcebCVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.