CVE-2019-25306
Published: 11 February 2026
Summary
CVE-2019-25306 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Tucows (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2019-25306 is an unquoted service path vulnerability (CWE-428) affecting BlackMoon FTP Server version 3.1.2.1731. The issue resides in the service configuration, where the binary path lacks proper quotation, allowing local users to potentially execute arbitrary code with elevated system privileges under the LocalSystem account during service startup. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-11.
Local low-privileged users can exploit this vulnerability by placing a malicious executable in a directory that the unquoted service path traverses during resolution. When the service starts, the attacker's code executes with LocalSystem permissions, enabling high-impact confidentiality, integrity, and availability violations, such as full system compromise.
Advisories and references include a Vulncheck notice detailing the unquoted service path in BlackMoon FTP Server's BMFTP release, an Exploit-DB entry (47521) with a public exploit, and a Tucows preview page for the software. No patches or specific mitigations are described in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19452
Vulnerability details
BlackMoon FTP Server 3.1.2.1731 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to insert malicious code that would execute…
more
with LocalSystem account permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unquoted service path (CWE-428) enables path interception by placing malicious binary in traversed directories for LocalSystem execution on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings for system components, including properly quoting service binary paths to prevent path hijacking exploits.
Enforces least privilege for service accounts, preventing LocalSystem-level privilege escalation even if an unquoted service path is exploited.
Requires timely identification, reporting, and correction of flaws such as unquoted service paths through remediation processes.