CVE-2016-15003: 
FileZilla FTP Client vulnerability analysis and mitigation

A vulnerability was discovered in FileZilla Client 3.17.0.0 affecting the uninstall.exe component located in 'C:\Program Files\FileZilla FTP Client'. The vulnerability was identified and later fixed in version 3.17.0.1 (CVE Mitre, NVD).

The vulnerability is classified as an unquoted search path issue in the installer component. The unquoted command path used by the uninstaller is 'C:\Program Files\FileZilla FTP Client\uninstall.exe', which can be exploited due to the unquoted spaces in the path (Exploit DB).

This vulnerability could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. The attack can be initiated remotely, and the exploit has been publicly disclosed (CVE Mitre).

The vulnerability can be exploited by placing a malicious executable named 'Program.exe' in the C: directory (or 'Filezilla.exe'/'Filezilla FTP.exe' in Program Files). When the uninstallation process is initiated, the malicious program would be executed with administrator rights (Exploit DB).

The vulnerability was patched in FileZilla Client version 3.17.0.1. Users should upgrade to this version or later to mitigate the risk (Exploit DB).