untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24ORiJFTgQw71FNVJsSMmh6uJ82NEEyxzMELEDF3altrSOCjZCIXebhmAIMXtkydEsotopuLS1u0eBDLU1TZ66go=

OpenBSD 6.6 errata 015, December 20, 2019:

ftp(1) will follow remote redirects to local files.

Apply by doing:
    signify -Vep /etc/signify/openbsd-66-base.pub -x 015_ftp.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install ftp:
    cd /usr/src/usr.bin/ftp
    make obj
    make
    make install

Index: usr.bin/ftp/fetch.c
===================================================================
RCS file: /cvs/src/usr.bin/ftp/fetch.c,v
diff -u -p -u -r1.172 fetch.c
--- usr.bin/ftp/fetch.c	9 Oct 2019 16:43:22 -0000	1.172
+++ usr.bin/ftp/fetch.c	19 Dec 2019 00:08:44 -0000
@@ -243,6 +243,9 @@ url_get(const char *origline, const char
 	} else
 		errx(1, "url_get: Invalid URL '%s'", newline);
 
+	if (isfileurl && redirect_loop > 0)
+		errx(1, "Redirection to local file not permitted");
+
 	if (isfileurl) {
 		path = host;
 	} else {