CVE-2026-119147 in ProFTPD
Summary
by MITRE • 10/30/2026
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in ProFTPD versions prior to 1.3.9e and the release candidate 1.3.10rc5 represents a critical authorization bypass within the mod_sftp module's file copy extension handler. This flaw specifically affects the logic governing how files are duplicated from one location on the server filesystem to another via the SFTP protocol. The core technical deficiency lies in the failure of the internal access control mechanisms to enforce Limit WRITE directives when creating new destination files during a copy operation. In standard FTP and SFTP operations, administrators configure directory-level restrictions using LIMIT blocks to explicitly permit or deny specific actions such as upload, download, delete, or write. While these controls are correctly applied to initial file uploads from the client side, they were not properly validated for internal server-side copy commands initiated by authenticated users through mod_sftp.
From a technical perspective, this issue stems from an incomplete implementation of access control checks within the SFTP subsystem's handling of the SSH_FXP_OPEN and related operations used during file copying. When a user requests to copy a source file to a destination path located in a directory where write permissions are explicitly denied via configuration directives like Limit WRITE DenyAll, the server fails to perform the necessary authorization check against the target location before allowing the creation of the new file instance. The system correctly verifies that the user has read access to the source file but neglects to verify if they have write or create-file privileges for the destination directory. This oversight allows an authenticated attacker to bypass administrative restrictions intended to isolate sensitive data or restrict storage usage in specific directories, effectively treating internal copy operations as exempt from standard upload security policies.
The operational impact of this vulnerability is significant for organizations relying on ProFTPD for secure file transfer services with granular access controls. An authenticated user can exploit this flaw to write files into any directory where they have been explicitly denied write permissions. This capability undermines the principle of least privilege and can lead to several adverse outcomes, including unauthorized data persistence in restricted areas, potential disruption of service if critical system directories are targeted, or the placement of malicious scripts in web-accessible but upload-restricted folders for subsequent exploitation. Furthermore, this bypass facilitates lateral movement within the server's filesystem by allowing users to move sensitive files from protected locations into accessible ones, thereby compromising confidentiality and integrity without needing elevated privileges.
This vulnerability is classified under CWE-269, which denotes Improper Privilege Management, specifically highlighting a failure in enforcing access control policies during specific operational contexts. In terms of the MITRE ATT&CK framework, this behavior aligns with T1083 File and Directory Discovery combined with T1564 Hidden Files and Directories if used to evade detection, but more accurately maps to T1222 File Permission Modification as it involves circumventing intended file system permissions. It also relates to T1078 Valid Accounts since the attack requires prior authentication, exploiting a flaw in how those valid accounts are authorized for specific actions within restricted zones.
Mitigation strategies primarily involve upgrading ProFTPD to version 1.3.9e or later, where this authorization bypass has been patched by ensuring that Limit WRITE checks are consistently applied during all file creation operations, including internal copies initiated via mod_sftp. For environments unable to upgrade immediately due to compatibility constraints, administrators should consider restricting SFTP access for users who do not strictly require it, thereby reducing the attack surface. Additionally, implementing strict chroot jails can limit the filesystem visibility and write capabilities of user sessions, making exploitation more difficult even if the vulnerability is present. Regular auditing of ProFTPD configuration files against current security best practices and monitoring logs for unusual file creation patterns in restricted directories are also recommended defensive measures to detect potential abuse attempts.