CVE-2018-25366

CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by injecting malicious payload into the Site Manager label field. Attackers can craft a payload exceeding 520 bytes that overwrites the return address and executes shellcode when a shortcut is created and launched.

Score

CVSS 4.0 8.6 High

Status

Deferred - disclosure@vulncheck.com

Published

2026-05-25

Last modified

2026-05-26

Weaknesses

CWE-120

Affected products

• Cuteftp (Globalscape)

References

• http://installer.globalscape.com/pub/cuteftp/archive/english/cuteftp50.exe
• https://www.exploit-db.com/exploits/45259
• https://www.vulncheck.com/advisories/cuteftp-xp-buffer-overflow-via-site-manager-label-field