Authenticated UNC path injection in Cerberus FTP Server by Cerberus exposes Net-NTLMv2 hashes

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

• The CNA record marks Cerberus FTP Server on Windows as affected for the structured range with version: 0, lessThan: 2026.3.0, and status: affected; defaultStatus is unaffected.
• The technical advisory identifies Cerberus FTP Enterprise 2026.1.0 as a vulnerable tested configuration.
• The record and advisory identify 2026.3.0 as resolving the issue.
• The consulted release notes list 2026.3.1, but the returned content does not map that release separately to this issue. Do not infer coverage for other release branches beyond the confirmed boundary above.

The flaw is in the web client's file-upload validation flow at the file/json/check-upload endpoint. An authenticated remote user can control the relPath and cd parameters; relPath lacked adequate validation or sanitization, while cd was not tightly restricted to the user's existing virtual directory. When the application processes an attacker-supplied UNC path, the server performs a server-side file-existence check in the security context of the Windows service account running Cerberus, which can initiate SMB authentication to an attacker-controlled host. The resulting Net-NTLMv2 hash may then be subject to offline cracking or NTLM relay, depending on authentication policy and network configuration. The record classifies the weakness as CWE-40; the available evidence does not establish that other path-processing flows outside this web-client component are affected.

The issue is remotely reachable by an authenticated user, requires low privileges, does not require additional user interaction, and can be triggered through the web client upload-check flow. The documented sequence begins when the user submits a file-check request containing an attacker-controlled UNC path, causing the server to make an outbound SMB request. A public advisory contains a proof of concept demonstrating disclosure of the service account's authentication material. The supplied evidence does not establish exploitation in real-world campaigns; in-the-wild exploitation status remains unknown.

A request from an authenticated user can cause the Cerberus server to make an outbound SMB connection using the identity of its Windows service account. The direct technical outcome is disclosure of Net-NTLMv2 authentication material, not an established direct change to server data or availability. Organisational risk arises if the captured hash is cracked or relayed to another service; the practical consequence depends on the service-account password, NTLM policy, network segmentation, and relay protections. The available evidence does not establish direct code execution, file modification, or administrative takeover as an immediate consequence of the flaw.

• Credential disclosure: The service account's Net-NTLMv2 hash may be sent to an attacker-controlled SMB host.
• Related access risk: Depending on password strength, NTLM policy, network segmentation, and relay protections, the captured material may be cracked offline or relayed to another service.
• Direct effect: The evidence establishes exposure of authentication material; it does not establish that the flaw directly modifies files, executes code, or disrupts service availability.
• Operational visibility: Outbound SMB authentication may be difficult to identify through application logs alone, so incident review should combine Cerberus, Windows, and network telemetry.

1. Upgrade Cerberus FTP Server to 2026.3.0, the exact release confirmed by the record and advisory as addressing the issue.
2. If immediate upgrading is not possible, treat deployments in the affected range as exposed and evaluate temporary controls that reduce web-client access and prevent unnecessary outbound SMB connectivity from the Cerberus host. These are risk-reduction measures, not a vendor-confirmed fix.
3. After upgrading, verify the installed release on every server, retest the web client, and review historical logs for UNC-like requests or unexpected outbound SMB authentication.
4. The supplied evidence does not document a separate official workaround. Deployments on other branches should be confirmed with the vendor before being treated as remediated.

• Inventory all Windows systems running Cerberus FTP Server and compare their installed versions with the affected range in affected_summary.
• Identify deployments with the web client enabled and external accounts permitted to perform file-upload operations.
• Review administrative console logs for requests to file/json/check-upload, especially unusual relPath values, UNC-like paths, or empty cd values.
• Inspect outbound SMB traffic from Cerberus hosts to unapproved destinations, together with NTLM authentication events generated by the Cerberus service account.
• Review Windows, firewall, and network telemetry for unexpected SMB connections associated with affected servers. Absence of a matching log entry does not prove safety because the advisory notes that outbound SMB authentication may not be immediately visible without active monitoring.