RUSTSEC-2026-0271: FTP command injection via CRLF in control channel arguments

What to do

1. See which version you have: cargo tree -i suppaftp (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p suppaftp. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example suppaftp = "10.0.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of suppaftp wrote command arguments (user name, password, paths, SITE arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (\r) or a line feed (\n) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.

An application that passes untrusted input as credentials, paths or command strings to methods such as login, cwd, mkdir, rmdir, rm, rename, retr, put_file, site or custom_command can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected PORT.

All three clients are affected: sync, tokio and smol, with or without TLS.

The flaw was corrected in version 10.0.2 (commit 194bdd1): every command line is validated before it is written to the wire and rejected with FtpError::ConnectionError (std::io::ErrorKind::InvalidInput) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, custom_command no longer accepts several commands joined by CRLF in a single call.

Users who cannot upgrade should reject or strip \r and \n from any untrusted string before passing it to the client.

References

• Package: crates.io/crates/suppaftp
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0271.html
• Web: github.com/veeso/suppaftp/pull/172

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.