Filezilla versions 3.0.9.2 and below allow local users access to all saved passwords due to the fact that they are stored in plain text in sitemanager.xml.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/65662/filezilla-disclose.txt
Source: https://packetstormsecurity.com/files/65662/filezilla-disclose.txt.html