CVE-2023-38960 is a High severity (CVSS 7.3) insecure permissions flaw in Raiden Professional Server RaidenFTPD 2.4 build 4005. A local attacker could gain privileges by running a crafted executable from the installation directory. The record names no fixed build, so ask the vendor and tighten directory permissions now.
What's affected
The record lists RaidenFTPD 2.4 build 4005 as the affected product. It does not name a fixed build, and the single reference in the record, a personal write-up on a blogging site, was blocked from automated access when this post was reviewed. We therefore cannot confirm whether a later build fixes the issue.
What the record does say is narrow and clear. The problem needs local access to the machine that runs the FTP server, and the attacker needs a low-privilege account (the vector shows PR:L). It also needs user interaction (UI:R), which in practice means a privileged user or the service itself must run the planted file.
If you run RaidenFTPD, contact the vendor or check its release notes for a build later than 4005 and for guidance on installation directory permissions. Do not assume that a newer version number means the fix is included without confirming.
How to check if you're exposed
The weakness is about who can write to the installation directory, so look at that directly. On Windows, list the access control entries on the folder where RaidenFTPD is installed:
icacls "C:\path\to\RaidenFTPD"
Replace the path with your real install location. Look for entries that give Users, Authenticated Users or Everyone write, modify or full control. Any such entry means ordinary users can place files where a privileged process may run them.
Also confirm which account the FTP service runs as. A service that runs as a high-privilege account makes the impact larger.
What to do now
- Confirm whether you run RaidenFTPD 2.4 build 4005 and where it is installed.
- Remove write and modify rights for non-administrators from the installation directory and its subfolders.
- Run the service under a dedicated low-privilege account instead of an administrator or SYSTEM-level account.
- Ask the vendor whether a fixed build exists, and plan to move to a maintained FTP or SFTP server if it does not.
- Monitor the install directory for new or changed executables.
Why it matters
The record maps this to CWE-276 (incorrect default permissions). When a privileged program lives in a folder that ordinary users can write to, a user can drop in a file that the privileged program, or an administrator, will later run. The code then runs with the higher privileges. This is a local privilege escalation, not a remote attack, and it is common on software installed with permissive defaults.
The practical risk depends on who can log in to the host. A shared server, a jump host or a machine where many staff have accounts is a more serious case than a locked-down single-purpose box. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog. Because file transfer servers often sit on the edge of a network and hold sensitive files, it is worth reviewing the whole deployment, not only this one permission setting.
Quick check
Can this be exploited over the network?
Not by itself. The record's vector is local: the attacker needs an account on the machine and a privileged process or user to run the planted file.
Is there a patched version?
The record does not name one. Check with the vendor, and apply directory permission hardening in the meantime.
Sources
- Researcher write-up listed in the record (blocked from automated access when reviewed)
- Record data for CVE-2023-38960: NVD description, CVSS vector and CWE
Last reviewed: 19 October 2026.
