This vulnerability in ColoradoFTP Server (≤ 1.3 Build 8 for Windows) arises from improper limitation of pathname to a restricted directory (CWE-22). Attackers can submit crafted FTP GET and PUT commands containing directory traversal sequences to access or modify files outside the intended FTP root directory. The issue stems from insufficient sanitization of user-supplied file paths, enabling unauthorized file system access without authentication. The vulnerability is specific to the Windows platform version of ColoradoFTP Server. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation allows unauthenticated attackers to read or write arbitrary files on the affected system outside the FTP root directory. This can lead to unauthorized disclosure of sensitive information, modification or deletion of critical files, and potential system compromise. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation over the network without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the FTP server to trusted networks and monitor for suspicious FTP commands. Consider disabling or limiting FTP PUT and GET commands if possible. Avoid exposing the vulnerable ColoradoFTP Server version to untrusted networks.