FileZilla Project maintains a focused pair of file-transfer applications: FileZilla Client, a widely used FTP/SFTP desktop tool, and FileZilla Server, a corresponding server implementation. The vendor's disclosures cluster around the client and server products and reflect the parsing and protocol-handling demands of FTP and secure file-transfer implementations. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Filezilla Project over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-0160HIGH The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive inform | Apr 7, 2014 | 7.5 | 99 | YES | YES |
CVE-2014-0224HIGH OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to | Jun 5, 2014 | 7.4 | 83 | NO | YES |
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet | Dec 18, 2023 | 5.9 | 81 | NO | YES |
CVE-2006-6565MEDIUM FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL po | Dec 15, 2006 | 4.0 | 77 | NO | YES |
CVE-2005-3589HIGH Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a denial of service (terminal crash) via a long USER ftp command. | Nov 16, 2005 | 7.8 | 66 | NO | YES |
CVE-2023-53959CRITICAL FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. At | Dec 19, 2025 | 9.8 | 34 | NO | NO |
CVE-2006-2173MEDIUM Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PAS | May 4, 2006 | 6.4 | 29 | NO | YES |
CVE-2016-15003HIGH A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client | Jul 18, 2022 | 7.8 | 26 | NO | NO |
CVE-2019-5429HIGH Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory. | Apr 29, 2019 | 7.8 | 26 | NO | NO |
CVE-2005-0850MEDIUM FileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name such as CON, NUL, COM1, LPT1, a | May 2, 2005 | 5.0 | 26 | NO | YES |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Filezilla Project.
Media articles that mention a CVE ID that affects a product developed by Filezilla Project — matched by CVE ID, not by vendor name.