Threats affecting pkg:golang/ftpserverlib

fclairamb ftpserverlib versions up to 0.32.4 have a vulnerability where sensitive information such as file contents and directory listings can be transmitted in cleartext. This occurs because the software only checks a transferTLS flag set by the PROT command, not whether the actual data connection uses TLS. As a result, even with mandatory encryption configured, data can be sent unencrypted if the client sends PROT P after PASV or PORT commands, exposing data to on-path attackers.