PT-2026-40802 · Python · Cpython

Bénédikt Tran + 1 · Published 2026-05-13 · Updated 2026-05-22 · CVE-2026-8328

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified)

Description The ftpcp() function in Lib/ftplib.py fails to use the actual peer address, instead trusting the host address supplied by the server during a PASV command. This occurs because ftpcp() calls parse227() directly and passes the raw, attacker-controllable IP address and port to target.sendport(), leading to a Server-Side Request Forgery (SSRF), where a server is tricked into making unintended requests to internal or external resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-LIBPYTHON-2026-8328

BIT-PYTHON-2026-8328

BIT-PYTHON-MIN-2026-8328

CVE-2026-8328

ECHO-1E9D-9CBE-8622

PSF-2026-24

Affected Products

Cpython

References · 20

• https://github.com/python/cpython/pull/149648 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-8328 · Vendor Advisory
• https://mail.python.org/archives/list/[e-mail]/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8328 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8328 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2026-8328 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-libpython-2026-8328 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-0000-CVE-2026-8328 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8328 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8328 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2026-24 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2026-8328 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8328 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8328 · Vendor Advisory
• https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9 · Note