The FTPServerLib library incorrectly validates TLS usage for data transfers. The TransferOpen function checks only the transferTLS flag set by the PROT command and does not confirm that the underlying data connection itself is encrypted. As a consequence, after a client sends PROT P following PASV or PORT, file contents and directory listings are transmitted in cleartext even when the server is operating with mandatory encryption, allowing attackers to read or alter data.

fclairamb's FTPServerLib is affected for all versions up to and including 0.32.4. The issue exists in the client_handler and handle_misc modules of those releases.

The CVSS score of 6.3 indicates medium severity, and the EPSS score is not reported, making the exact likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog, but an attacker who can intercept the network traffic between the FTP client and server can exploit this flaw. The likely attack vector is network-based; an on‑path adversary can read or tamper with data once the client issues PROT P after establishing a data connection.