CVE-2022-2560

What it actually does

The flaw is an unauthenticated path traversal issue in EnterpriseDT CompleteFTP 22.1.0 Server's HTTP file-handling logic, specifically the HttpFile class. The server fails to properly canonicalize and validate user-supplied paths before performing file deletion operations, allowing a remote attacker to reference paths outside the intended web or file-transfer directory. Because the affected service can perform the delete operation in the context of the Windows SYSTEM account, successful exploitation can remove arbitrary files accessible to that account. The primary technical impacts are integrity loss and availability loss; the issue is not primarily a confidentiality vulnerability because it enables deletion rather than file readout. The provided package metadata also lists Debian 11 Chromium fixed in 113.0.5672.126-1~deb11u1, which should be validated against the authoritative vendor advisory because it does not align with the CompleteFTP product description.

Why it matters to the business

An unauthenticated attacker could remotely delete critical application, configuration, log, or operating-system files from an exposed file-transfer server, causing service outages, data loss, failed backups, or system instability. If exploited against production file-transfer infrastructure, the result could be business interruption, loss of customer or partner file exchange capability, and expensive restoration from backups. The high CVSS score and high EPSS value indicate this should be treated as urgent even though it is not listed in CISA KEV and no ransomware association is currently indicated.

How an attack unfolds

An attacker first identifies an Internet-facing or otherwise reachable CompleteFTP server exposing the vulnerable HTTP file interface. They then send unauthenticated HTTP requests that invoke file deletion behavior while supplying a crafted path containing traversal sequences or encoded traversal variants. Because the vulnerable HttpFile logic does not reliably normalize and constrain the requested path to the intended file root before using it in filesystem operations, the request can resolve to a file elsewhere on the host. The server processes the operation under its service account, reported as SYSTEM on affected installations, and deletes the targeted file if filesystem permissions allow it. An attacker may repeat the process to remove application files, configuration files, logs, scheduled task files, or other operationally important artifacts, potentially causing denial of service or impairing investigation and recovery.

How to fix it

Upgrade affected EnterpriseDT CompleteFTP Server installations to a vendor-fixed release newer than the vulnerable 22.1.0 build, following EnterpriseDT's official advisory and release notes. If this identifier is being tracked through Debian Chromium package metadata, verify the product mapping and ensure Debian 11 systems have Chromium updated to at least 113.0.5672.126-1~deb11u1. Until the affected CompleteFTP service can be upgraded, restrict access to the HTTP file interface to trusted networks, place it behind VPN or strong reverse-proxy access controls, disable unnecessary HTTP file-management features, and block unauthenticated delete operations where feasible. Run the service under a least-privileged account rather than SYSTEM where supported, and ensure filesystem ACLs prevent the service account from modifying operating-system, application, backup, and log directories outside the intended file-transfer root. Maintain tested backups and file integrity monitoring for critical server paths.

How to confirm the fix worked

Confirm the installed CompleteFTP Server version is no longer 22.1.0 or any other vendor-designated vulnerable build. Review the vendor release notes or administrative console to verify the patched version. Validate that the HTTP file interface is not publicly reachable unless explicitly required and protected. Confirm the service process is not running with unnecessary SYSTEM-level privileges where least-privilege configuration is possible. Review filesystem ACLs to ensure the service account can delete files only within intended managed directories. For Debian 11 assets where the package feed maps this identifier to Chromium, validate with package management tooling that chromium is installed at 113.0.5672.126-1~deb11u1 or later. Perform controlled, authorized negative testing to ensure traversal-style paths are rejected and do not delete files outside the configured file root.

Typical attack path

1. Discover an exposed CompleteFTP HTTP service through scanning, asset inventory leaks, or banner identification.
2. Confirm the target is running an affected CompleteFTP 22.1.0 Server build or otherwise vulnerable HTTP file-handling component.
3. Send unauthenticated HTTP requests to the file-management endpoint with path traversal sequences in a file path parameter or URL path used by delete functionality.
4. Use traversal or encoded traversal variants to escape the intended file directory and reference files elsewhere on the server.
5. Trigger the vulnerable delete operation, causing the service to remove the referenced file using its process privileges.
6. Repeat deletion attempts against high-impact targets such as application configuration, service data, logs, or files required for startup.
7. Observe service errors, missing files, or degraded availability to confirm impact.

How to detect it

Review CompleteFTP server logs, web access logs, reverse-proxy logs, WAF logs, EDR filesystem telemetry, Windows Security events, and file integrity monitoring for evidence of unauthenticated delete requests containing path traversal patterns. Focus on HTTP requests to file-management or delete functionality that include '../', '..\', encoded traversal strings such as '%2e%2e%2f', or attempts to reference Windows system, application, configuration, or log paths outside the configured transfer root. Correlate suspicious requests with file deletion events performed by the CompleteFTP service process or service account, especially deletions occurring shortly after inbound requests from the same source IP. On Windows hosts, examine Security Event ID 4663 if object access auditing is enabled, Sysmon Event ID 23 or 26 for file deletion, Sysmon Event ID 11 for suspicious file creation/replacement patterns, service crashes, and application errors following deletion attempts. Look for gaps or sudden truncation in CompleteFTP logs, missing configuration files, unexpected service restarts, and failed service startups. Because attackers may delete logs to impede investigation, compare local logs with centralized SIEM, proxy, WAF, EDR, and backup snapshots.

• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• ..%2f
• ..%5c
• /../
• \..\
• HttpFile
• DELETE
• C:\Windows\
• C:\Windows\System32\
• C:\Program Files\
• C:\ProgramData\
• CompleteFTP
• CompleteFTPServer
• EnterpriseDT
• Event ID 4663
• Sysmon Event ID 23
• Sysmon Event ID 26

What your security team should do

• Prioritize identification of exposed CompleteFTP Server instances and determine whether any are running version 22.1.0 or another vendor-confirmed vulnerable build.
• Patch or upgrade affected CompleteFTP servers immediately; treat Internet-facing systems as highest priority due to unauthenticated network exploitability and high EPSS.
• Restrict network exposure of CompleteFTP HTTP file-management functions to trusted administrative or partner networks only.
• Review and reduce service account privileges; avoid running file-transfer services as SYSTEM where operationally possible.
• Harden filesystem permissions so the service can write and delete only within approved transfer directories.
• Enable or tune WAF, reverse-proxy, and application logging to alert on traversal strings and suspicious delete requests.
• Check backups and recovery procedures for critical CompleteFTP-hosted data and configuration before and after remediation.
• Conduct retrospective log review for suspicious path traversal and delete activity, especially around externally reachable services.
• Validate the inconsistent product/package mapping in vulnerability management tools so remediation tracking does not incorrectly focus only on Debian Chromium when CompleteFTP exposure is present.