This vulnerability (CVE-2025-34110) in ColoradoFTP Server ≤ 1.3 Build 8 for Windows is due to improper limitation of pathname to a restricted directory (CWE-22). The FTP server fails to properly sanitize user-supplied file paths in the GET and PUT command handlers, allowing directory traversal sequences to escape the configured FTP root directory. As a result, unauthenticated attackers can read or write arbitrary files on the system, potentially accessing sensitive data or modifying system files. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated remote attackers to read or write arbitrary files outside the FTP root directory on affected Windows systems. This can lead to unauthorized disclosure of sensitive information and unauthorized modification of system files, severely compromising system confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the FTP server to trusted networks and monitor for suspicious FTP activity. Avoid exposing the vulnerable ColoradoFTP Server version to untrusted networks.