Change default security of `ftplib.FTP_TLS`

Bug report

Bug description:

Hi!

It has come to my attention that the ftplib.FTP_TLS class shyly notes in its documentation — it does not warning — that it is insecure by default: it leaves the data connection without TLS and vulnerable to man-in-the-middle attacks. Documenting that calling .prot_p() closes that hole is better than nothing but misses the point: vulnerable defaults need to be fixed, just XML parsers must not be vulnerable to XXE by default.

To see the issue in action, you can run this script…

# /usr/bin/env python3
# Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
# SPDX-License-Identifier: 0BSD

from sys import stdout
from ftplib import FTP_TLS

ftps = FTP_TLS('test.rebex.net')
ftps.login(user="demo", passwd="password")
ftps.retrbinary('RETR readme.txt', stdout.buffer.write)  # <-- MITM here
ftps.quit()

…and watch sudo tcpdump -i any -A 2>/dev/null | grep -F "Rebex FTP/SSL" output in another terminal to see the MITM in action.

A pull request with a fix and extending documention on security is upcoming.

I'm looking forward to your review and am hoping for your support 🙏

Related:

• issue #91826 is another unfixed MITM vector due to lack of FTPS certificate validation 😞
• issue #63699 is breaking FTPS with most servers for 12+ years now, would be great to have that fixed 🙏

CC @The-Compiler @hannob @nitram2342

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-143498

Commencez par le point d’entrée ftplib.FTP_TLS et sa documentation associée, puis examinez la reproduction montrant une connexion de données non protégée. Consultez le PR associé gh-143498 pour voir le travail déjà en cours ; la finalisation devrait corriger la valeur par défaut non sécurisée et documenter le comportement de sécurité qui en résulte.