FileZilla Denial-of-Service Vulnerability in Local Search Functionality

A denial-of-service vulnerability has been identified in FileZilla version 3.40.0. This issue arises in the local search feature, where a local attacker can crash the application by providing a malformed path string. The crash is triggered by entering a path that includes 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field, and then starting a local search operation.

Impact

Exploitation of this vulnerability leads to a crash of the FileZilla application, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by entering a crafted path into the search directory field of the local search functionality. The path must consist of 384 'A' characters followed by 'BBBB' and 'CCCC' sequences. Once the path is entered, initiating the local search operation will cause the application to crash.