CRLF Injection Affecting aioftp package, versions [,0.26.3)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-AIOFTP-13304441
- published6 Oct 2025
- disclosed2 Oct 2025
- creditCycloctane
Introduced: 2 Oct 2025
New CVE NOT AVAILABLE CWE-93 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade aioftp to version 0.26.3 or higher.
Overview
aioftp is a ftp client/server for asyncio
Affected versions of this package are vulnerable to CRLF Injection via the aioftp.Client.command method that lacks checks for CR/LF characters in command strings. An attacker can add the \r\n characters and inject additional headers in the FTP request sent.