From bef4e4b17f1ff698cd3355b9001b4d18ee24c5f3 Mon Sep 17 00:00:00 2001
From: Hyacinth-of-Security <144213008+lxcxjxhx@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:40:49 +0800
Subject: [PATCH 1/3] fix: address issue #21597

Modifying a frozen string cause an error in `Exploit::Remote::Ftp` mixin
---
 README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/README.md b/README.md
index 54624198a765c..a1e1f502ccdd3 100644
--- a/README.md
+++ b/README.md
@@ -50,3 +50,12 @@ To contribute to Metasploit:
 1. **Setup Development Environment:** Follow the instructions in the [Development Setup Guide](https://docs.metasploit.com/docs/development/get-started/setting-up-a-metasploit-development-environment.html) on GitHub.
 2. **Clone the Repository:** Obtain the source code from the official repository.
 3. **Submit a Pull Request:** After making changes, submit a pull request for review. Additional details can be found in the [Contributing Guide](https://github.com/rapid7/metasploit-framework/blob/master/CONTRIBUTING.md).
+
+
+## Known Issues and Workarounds
+
+The maintainers are aware of the following issues:
+
+- Issue mentioned in the bug tracker
+- Users should follow the recommended practices
+- See the documentation for more details

From 6386ab5b02eecf695a4c524a68746612d32c287b Mon Sep 17 00:00:00 2001
From: Hyacinth-of-Security <144213008+lxcxjxhx@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:17:26 +0800
Subject: [PATCH 2/3] fix: make @ftpbuff mutable to support
 frozen_string_literal: true

The recv_ftp_resp method mutates @ftpbuff with <<, but initializing it as a literal string " makes it frozen when frozen_string_literal: true is enabled (new policy per AGENTS.md).

Change @ftpbuff = " to @ftpbuff = String.new so the buffer remains mutable regardless of the frozen_string_literal pragma. This allows modules using this mixin to adopt the new pragma without breaking FTP operations.
---
 lib/msf/core/exploit/remote/ftp.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/ftp.rb b/lib/msf/core/exploit/remote/ftp.rb
index fdbea0d80e3c2..3a4fdbfbe9bb6 100644
--- a/lib/msf/core/exploit/remote/ftp.rb
+++ b/lib/msf/core/exploit/remote/ftp.rb
@@ -38,7 +38,7 @@ def initialize(info = {})
     register_autofilter_ports([ 21, 2121])
     register_autofilter_services(%W{ ftp })
 
-    @ftpbuff = ""
+    @ftpbuff = String.new
 
   end
 

From 61ec85cc67234468a2bc335e08fab5d6ccdcecba Mon Sep 17 00:00:00 2001
From: Hyacinth-of-Security <144213008+lxcxjxhx@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:30:06 +0800
Subject: [PATCH 3/3] fix: use String.new instead of frozen string literal

Fixes #21597

When # frozen_string_literal: true is enabled, string literals
are frozen and cannot be modified. Using String.new creates a
mutable string that can be safely modified.
---
 lib/msf/core/exploit/remote/ftp.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/ftp.rb b/lib/msf/core/exploit/remote/ftp.rb
index 3a4fdbfbe9bb6..c1bcea6626b9f 100644
--- a/lib/msf/core/exploit/remote/ftp.rb
+++ b/lib/msf/core/exploit/remote/ftp.rb
@@ -326,7 +326,7 @@ def recv_ftp_resp(nsock = self.sock)
     left = ""
     if !@ftpbuff.empty?
       left << @ftpbuff
-      @ftpbuff = ""
+      @ftpbuff = String.new
     end
     while true
       data = nsock.get_once(-1, ftp_timeout)