CVE-2007-4909

CVE-2007-4909 describes an interpretation conflict in WinSCP versions prior to 4.0.4, allowing remote attackers to perform arbitrary file transfers. This vulnerability arises from WinSCP misinterpreting file-transfer commands embedded in the final portion of SCP, SFTP, or FTP URLs, particularly when a web browser's protocol handler interprets parts of the URL differently than WinSCP. With a CVSS score of 9.3 (Critical), the vulnerability has a network attack vector, medium attack complexity, and high impacts on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit module for WinSCP 4.0.3 exists on ExploitDB, though there is no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion or media coverage.