This vulnerability arises from inconsistent patching in CPython's ftplib module. The ftpcp() function fails to sanitize or validate server-supplied IP addresses and ports, unlike the patched makepasv() function. As a result, an attacker controlling the FTP server response can supply malicious IP addresses and ports that are then used by the client, enabling SSRF attacks. The issue is related to CWE-918 and is a regression or incomplete fix following CVE-2021-4189. The CVSS 4.0 base score is 5.9, indicating medium severity with network attack vector, low attack complexity, partial attack traceability, no privileges required, and user interaction needed.

An attacker controlling or influencing the FTP server response can cause the client to make unintended network requests to arbitrary IP addresses and ports. This SSRF vulnerability may allow attackers to access internal resources or services not normally reachable by the client. However, exploitation requires user interaction and the attacker must control or manipulate the FTP server response. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the Python Software Foundation advisories for updates. Until a patch is released, avoid connecting to untrusted FTP servers or using the vulnerable ftpcp() function. No vendor advisory content is provided to indicate if any temporary mitigations or workarounds exist.