CVE-2022-2560: 
EnterpriseDT Complete FTP vulnerability analysis and mitigation

A critical vulnerability (CVE-2022-2560) was discovered in EnterpriseDT CompleteFTP Server version 22.1.0. The vulnerability, discovered by researcher rgod on June 7, 2022, allows remote attackers to delete arbitrary files on affected installations without requiring authentication. The flaw resides in the HttpFile class and stems from insufficient validation of user-supplied paths (Security Online, ZDI Advisory).

The vulnerability is classified as a path traversal flaw (CWE-22) that occurs due to improper validation of user-supplied paths in file operations. It received a CVSS v3.1 base score of 9.1 (Critical) from NIST and 8.2 (High) from Zero Day Initiative. The vulnerability allows attackers to perform file operations in the context of SYSTEM privileges (NVD, ZDI Advisory).

The exploitation of this vulnerability enables attackers to delete arbitrary files with SYSTEM level privileges on the affected system. Since the vulnerability doesn't require authentication, it poses a significant security risk to organizations using the affected CompleteFTP Server version (ZDI Advisory).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is rated as low, making it relatively straightforward to exploit (NVD).

EnterpriseDT has addressed this vulnerability in CompleteFTP version 22.1.1. Users are strongly advised to upgrade to this version or later to mitigate the risk (Security Online).