A directory traversal flaw in ColoradoFTP Server versions 1.3 Build 8 and earlier on Windows allows an unauthenticated FTP user to supply traversal sequences in the GET and PUT commands, leading to the ability to read, or even modify, any file outside the configured FTP root. The vulnerability stems from insufficient path validation (CWE‑22), lack of proper authorization checks (CWE‑306), and insufficient file permission handling (CWE‑552). An attacker could read system‑sensitive files such as configuration, credential stores, or program binaries, or alter critical system files to facilitate persistence or privilege escalation, thereby compromising confidentiality and integrity of the affected host. The impact is therefore full read/write access to arbitrary files on the server.

ColoradoFTP Server running on Windows, version 1.3 Build 8 or earlier, is affected. The vulnerability applies only to the Windows distribution and affects any instance where the FTP service is exposed on a network without proper authentication or restrictions.

The CVSS score of 9.3, coupled with an EPSS score of 51%, indicates a highly critical risk and a high likelihood of exploitation in the wild. Although the vulnerability is not listed in CISA’s KEV catalog, public exploits exist, including a Metasploit auxiliary module that automates traversal of the FTP file system. The attack vector is unauthenticated network traffic: an attacker simply connects to the FTP service, issues a GET or PUT command with a traversal sequence, and receives an arbitrary file or writes to one. The lack of authentication and the server’s file‑write capabilities together enable attackers to compromise the host, elevate privileges, or persist malicious code, making this flaw a serious threat to any unpatched ColoradoFTP deployment.