Filezilla versions 3.0.9.2 and below allow local users access to all saved passwords due to the fact that they are stored in plain text in sitemanager.xml.
baef52a04f5fee72b20d099e73501263952f3c0711e842c77dc3b827bb21bfec
A security issue in Filezilla 3.0.9.2 (and previous versions) allows
local users to retrieve all saved passwords because they're stored in
a plain text sitemanager.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<FileZilla3>
<Servers>
<Server>
<Host>ftpspace.domain.com</Host>
<Port>21</Port>
<Protocol>0</Protocol>
<Type>0</Type>
<Logontype>1</Logontype>
<User>user@domain.com</User>
<Pass>I'mAPlainTextPassword</Pass>