CVE-2024-41255

HIGH

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.3%
Percentile16th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, high complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-453: CWE-453
◆ AI Analysis — automated analysis, not human-reviewed

CVE-2024-41255 affects filestash v0.4 by skipping TLS certificate verification in FTPS, potentially enabling man-in-the-middle attacks.

BSID: BS-2024-GLOBAL-202591-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-41255?
CVE-2024-41255 affects filestash v0.4 by skipping TLS certificate verification in FTPS, potentially enabling man-in-the-middle attacks.
What is the CVSS score for CVE-2024-41255?
CVE-2024-41255 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 0.3%.
Is CVE-2024-41255 actively exploited?
No confirmed active exploitation of CVE-2024-41255 as of 2026-09-25.
How do I remediate CVE-2024-41255?
Priority: HIGH.
What systems are affected by CVE-2024-41255?
CVE-2024-41255 affects Filestash Filestash.
Vulnerability Details
CVE IDCVE-2024-41255
BSIDBS-2024-GLOBAL-202591-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2024-07-31
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-453
SourceNVD
Official Description

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can exploit the lack of TLS certificate verification in the Init function of index.go to intercept and manipulate FTPS communications, leading to data theft or tampering.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Filestash Filestash 0.4
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 806 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash011a3068949a31d390d8f5d3eb2118f71d56cb9e5d28852f98ec2eaaa51babc4152316de275929049550774f741247497c0ca265a5dd0cde438096ca84d20011
Related CVEs affecting Filestash
CVE-2024-41256 5.9 Default configurations in the ShareProofVerifier function of filestash v0.4 c... CVE-2024-41258 5.3 An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnor...
View all Filestash CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →