CVE-2010-10011 is a medium severity (CVSS 4.3) path traversal in Acritum Femitter Server 1.04, a Windows HTTP and FTP file sharing server. A remote user can reach files outside the intended folder. I could not confirm a fixed version, so the safe move is to retire it or keep it off the internet.
What's affected
The NVD record lists one version: Femitter Server 1.04. It says the affected function is unknown, that the attack can be launched remotely, and that an exploit has been disclosed publicly. The record gives the VulDB identifier VDB-250446.
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, which means network reachable, no account needed, user interaction required, and a low confidentiality impact. The VulDB wording calls it problematic. NVD and VulDB do not conflict on severity here.
There is no vendor advisory in the record, and no fixed version. The references are the VulDB entry and a public Exploit-DB listing, number 15445, which is titled as a directory traversal in Femitter FTP Server 1.04 and is dated November 2010. I could not load the VulDB page, so I am relying on the record and on the Exploit-DB title.
How to check if you're exposed
Femitter runs as a Windows program, so look for it on file servers and on older desktops that someone used to share files.
On a Windows machine, this lists running processes whose name includes femitter:
tasklist | findstr /i femitter
Then open the application and check the version in its about box. Version 1.04 is the one named in the record. For other versions, the record says nothing, so do not assume they are safe.
From a network view, find hosts listening on the ports you gave Femitter, which are usually the standard web and FTP ports, and ask whoever owns each host what it serves.
What to do now
- Find every Femitter instance and decide whether it is still needed.
- If it is not needed, uninstall it and remove the shared folders it exposed.
- If it is needed, move the service behind a VPN or a firewall rule that allows only known addresses.
- Move sensitive files out of the folders next to the shared directory, and review file permissions on the account Femitter runs under.
- Plan a move to a maintained file sharing service, since I found no confirmed fix for this product.
Why it matters
Path traversal bugs appear when a server builds a file path from user input and does not stop the input from climbing out of the folder it was meant to stay in. The server then returns a file the owner never intended to share. The impact is usually limited to reading files, which matches the low confidentiality score here.
The score is modest, but the exposure is simple: a public exploit exists, no account is needed, and the software is old. Small file servers like this tend to sit on a network for years. This CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing I read says it was exploited in the wild.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, which helps when you are not sure what a codebase pulls in.
Quick check
Is there a fixed version of Femitter Server?
I could not confirm one. The record lists only version 1.04 and gives no fix. Check with the vendor, and plan to replace the product.
Does this need a login to exploit?
According to the NVD vector, no privileges are required, but user interaction is. Treat any internet exposed Femitter server as at risk.
Sources
- Gold entry for CVE-2010-10011
- Exploit-DB 15445, Femitter FTP Server 1.04 directory traversal
- NVD record for CVE-2010-10011
Last reviewed: 19 October 2026.
