CVE-2021-3331

Name of the Vulnerable Software and Affected Versions WinSCP versions prior to 5.17.10

Description The issue allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. This is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.

Recommendations For versions prior to 5.17.10, update to version 5.17.10 or later to resolve the issue. As a temporary workaround, consider restricting the use of the URL handler for sftp:// URLs until a patch is applied.