FileZilla is a narrowly scoped file-transfer client and server platform that, despite a small product portfolio, ranks among the more prominent targets in its category due to widespread deployment for FTP and SFTP operations. The durable vulnerability signal centers on memory-handling issues and buffer-boundary conditions recurrent across FileZilla and FileZilla Server, with a notable tendency toward public exploit availability reflecting the appeal of this software to attackers seeking access or lateral movement. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Filezilla over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-0160HIGH The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive inform | Apr 7, 2014 | 7.5 | 99 | YES | YES |
CVE-2014-0224HIGH OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to | Jun 5, 2014 | 7.4 | 83 | NO | YES |
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet | Dec 18, 2023 | 5.9 | 81 | NO | YES |
CVE-2006-6565MEDIUM FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL po | Dec 15, 2006 | 4.0 | 77 | NO | YES |
CVE-2005-3589HIGH Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a denial of service (terminal crash) via a long USER ftp command. | Nov 16, 2005 | 7.8 | 66 | NO | YES |
CVE-2023-53959CRITICAL FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. At | Dec 19, 2025 | 9.8 | 34 | NO | NO |
CVE-2006-2173MEDIUM Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PAS | May 4, 2006 | 6.4 | 29 | NO | YES |
CVE-2016-15003HIGH A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client | Jul 18, 2022 | 7.8 | 26 | NO | NO |
CVE-2019-5429HIGH Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory. | Apr 29, 2019 | 7.8 | 26 | NO | NO |
CVE-2005-0850MEDIUM FileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name such as CON, NUL, COM1, LPT1, a | May 2, 2005 | 5.0 | 26 | NO | YES |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Filezilla.
Media articles that mention a CVE ID that affects a product developed by Filezilla — matched by CVE ID, not by vendor name.