If you have found a security vulnerability in pyftpdlib, please report it privately. Do not open a public issue. This gives me time to fix the problem and release a new version before the details are public.

Use GitHub's private vulnerability reporting: https://github.com/giampaolo/pyftpdlib/security/advisories/new

Please include:

• the pyftpdlib version (or commit) you tested
• the steps to reproduce it, ideally with a small proof of concept
• what an attacker can do with it, and what's required (e.g. an authenticated user, a specific server configuration)

I'll follow up on the advisory. Once a fix is released the advisory is published, a CVE is requested if needed, and you're credited as the reporter unless you prefer otherwise.