CVE-2010-2251

CVE-2010-2251 describes a critical vulnerability in LFTP versions prior to 4.0.6, specifically affecting the lftpget utility's get1 command. This flaw allows remote servers to dictate the destination filename of a download through a crafted Content-Disposition header, potentially leading to the creation or overwriting of arbitrary files. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity, enabling potential information disclosure, integrity compromise, and denial of service, and could even lead to arbitrary code execution if a dotfile in a home directory is targeted. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this decade-old vulnerability.