CVE-2018-10916

CVE-2018-10916 is a medium-severity vulnerability affecting lftp versions up to and including 4.8.3, as well as various Canonical and openSUSE products. It stems from improper sanitization of remote filenames during reverse mirroring, allowing a remote attacker to trick a user into deleting all files in their current working directory. The CVSS score of 6.5 indicates a network-based attack with low complexity, requiring user interaction, and resulting in high integrity impact (data loss). There is no evidence of active exploitation, publicly available exploit code, or significant community discussion, suggesting a low current threat level.