CVE-2026-102722 Server-side request forgery in NetX Duo
A malicious FTP server can direct the Eclipse NetX Duo client to connect to arbitrary addresses via the PASV command, enabling Server-Side Request Forgery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102722?
CVE-2026-102722 is a medium-severity server-side request forgery vulnerability in Eclipse Foundation NetX Duo, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
Weakness: CWE-918
Which versions are affected by CVE-2026-102722?
How do I fix CVE-2026-102722?
No fix has been published for CVE-2026-102722 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-102722 being exploited?
There is no known exploitation of CVE-2026-102722 in the wild and no public exploit code.
Sources
Also known as GHSA-j6g2-8fm3-rm8m, GHSA-p9rr-8wmf-9r7v.