CVE-2026-119364 in ProFTPD
Summary
by MITRE • 10/30/2026
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The ProFTPD software, specifically versions through 1.3.9e and release candidates from 1.3.10rc1 through 1.3.10rc4, contains a critical security flaw within the mod_copy module that undermines access control mechanisms designed to protect sensitive file system locations. This vulnerability is classified as CWE-59: Improper Link Resolution Before File Access, commonly known as a link-following or symlink attack. The core technical issue stems from how the FTP server handles symbolic links during copy operations initiated by authenticated users. When an attacker creates a symbolic link within a directory where they have write permissions and points that link to a file located in a restricted area, the mod_copy module fails to validate whether the target of the link resides outside the allowed scope before executing the operation.
The operational impact of this flaw is significant because it allows authenticated FTP users to bypass Limit WRITE restrictions effectively rendering access control lists ineffective for protecting specific directories or files. By utilizing the SITE COPY or SITE CPTO commands, an attacker can overwrite arbitrary files on the server that they should not have permission to modify. This capability enables a range of malicious activities including the modification of configuration files such as proftpd.conf which could lead to further privilege escalation, the replacement of web application scripts leading to remote code execution if those scripts are executed by a web service, or the corruption of critical system binaries and data stores. The vulnerability is particularly dangerous in shared hosting environments where multiple users share an FTP server instance, as one compromised account can be used to affect other services running on the same host.
From a threat intelligence perspective this behavior aligns with ATT&CK technique T1564: Host File System Attribute Modification and potentially T1083: File and Directory Discovery depending on how the attacker identifies target files for overwriting. The attack vector relies on local file system interactions rather than network protocol exploitation directly but is facilitated by remote authentication making it a remotely exploitable vulnerability given valid credentials are obtained through brute force or credential stuffing attacks against FTP services which often lack robust security controls compared to SFTP alternatives.
Mitigation strategies should prioritize upgrading ProFTPD to version 1.3.10rc5 or later where this issue has been addressed by implementing stricter validation of symbolic link targets during copy operations. Administrators who cannot immediately upgrade should disable the mod_copy module entirely if it is not required for their operational workflow as removing the vulnerable component eliminates the attack surface associated with SITE COPY and CPTO commands. Additionally enforcing chroot jails to restrict user access to specific directories can limit the ability of attackers to traverse the file system even if they manage to exploit this flaw though care must be taken to ensure that symlink resolution within chroots is also properly secured as some older implementations may still follow links out of jail environments depending on configuration settings. Regular auditing of FTP server configurations and limiting user permissions to only necessary directories further reduces risk exposure in production environments relying on legacy FTP protocols for file transfer operations.