The ftpcp() function in CPython's ftplib.py module fails to properly sanitize or replace server-supplied PASV host addresses, unlike the patched makepasv() function. This results in ftpcp() passing raw, attacker-controllable IP addresses and ports to the target.sendport() method, enabling server-side request forgery (CWE-918). The vulnerability is related to CVE-2021-4189, which addressed similar issues in makepasv(). The flaw affects CPython versions 3.14.0 and 3.15.0a1. No vendor advisory or patch is currently available to confirm remediation status.

An attacker can exploit this vulnerability to perform server-side request forgery (SSRF) attacks via the ftpcp() function in CPython's ftplib. This could allow an attacker to cause the server to make arbitrary network requests to internal or external systems, potentially leading to information disclosure or other indirect impacts. The CVSS 4.0 score of 5.9 indicates a medium severity impact with network attack vector, low attack complexity, and partial user interaction required.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should consider avoiding use of the ftpcp() function or applying manual code review and controls to limit exposure. No vendor-provided temporary or official fixes are currently documented.