How severe is CVE-2019-25683?

CVE-2019-25683 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2019-25683 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-25683?

CVE-2019-25683 affects Filezilla-project Filezilla Client. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-25683?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2019-25683 have an EU (EUVD) identifier?

Yes. CVE-2019-25683 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2019-20101.

When was CVE-2019-25683 published?

CVE-2019-25683 was published on 2026-04-05 and last updated on 2026-06-17.

CVE-2019-25683

CVE-2019-25683 is a medium-severity vulnerability in Filezilla-project Filezilla Client with a CVSS 3.x base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-532.

Key facts

Severity: Medium (CVSS 3.x base score 6.2)
CVSS v4: 6.9
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2019-20101
Weakness: CWE-532
Affected product: Filezilla-project Filezilla Client
Published: 2026-04-05
Last modified: 2026-06-17

Description

FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation.

Frequently asked questions

What is CVE-2019-25683?: FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation.
How severe is CVE-2019-25683?: CVE-2019-25683 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2019-25683 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-25683?: CVE-2019-25683 affects Filezilla-project Filezilla Client. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-25683?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2019-25683 have an EU (EUVD) identifier?: Yes. CVE-2019-25683 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2019-20101.
When was CVE-2019-25683 published?: CVE-2019-25683 was published on 2026-04-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:filezilla-project:filezilla_client:3.40.0:-:*:*:*:*:*:*

More vulnerabilities in Filezilla-project Filezilla Client

CVE-2023-53959 — Critical (CVSS 9.8): FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by…
CVE-2019-5429 — High (CVSS 7.8): Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp'…
CVE-2022-29620 — Medium (CVSS 6.5): FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.-…
CVE-2016-15003 — Medium (CVSS 6.3): A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects…
CVE-2024-31497 — Medium (CVSS 5.9): In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521…
CVE-2023-48795 — Medium (CVSS 5.9): The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows…

All CVEs affecting Filezilla-project Filezilla Client →

Other CWE-532 (Insertion of Sensitive Information into Log File) vulnerabilities

CVE-2022-36407 — Critical (CVSS 9.9): Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual…
CVE-2023-40029 — Critical (CVSS 9.9): Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively…
CVE-2021-32724 — Critical (CVSS 9.9): check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the…
CVE-2026-49200 — Critical (CVSS 9.8): The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file…
CVE-2026-22778 — Critical (CVSS 9.8): vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid…
CVE-2025-11008 — Critical (CVSS 9.8): The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…

Browse all CWE-532 (Insertion of Sensitive Information into Log File) vulnerabilities →