The vulnerability exists in the ftpcp() function in Lib/ftplib.py of CPython, which did not receive the same security update as makepasv() when addressing CVE-2021-4189. Specifically, ftpcp() calls parse227() directly and passes the raw, attacker-controllable IP address and port to target.sendport(), enabling server-side request forgery. This could allow an attacker to induce the client to send requests to arbitrary IP addresses and ports. The CVSS 4.0 score is 5.9 (medium severity), reflecting network attack vector, low attack complexity, partial attack traceability, no privileges required, user interaction needed, no confidentiality or availability impact, but high integrity impact.

An attacker can manipulate the ftpcp() function to cause the client to send network requests to arbitrary IP addresses and ports, potentially leading to unauthorized internal network access or other unintended interactions. The integrity of the client’s network communications can be compromised. There is no direct impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should exercise caution when using the ftpcp() function with untrusted FTP servers or inputs. Monitor official Python security advisories for updates.