CVE-2026-119567 in vsftpd
Summary
by MITRE • 10/30/2026
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in vsftpd versions through 3.0.5 represents a critical access control bypass that undermines the integrity of directory restrictions configured for authenticated users. This flaw specifically targets the command filtering mechanism intended to restrict user actions within their designated home directories or chroot environments. By exploiting this weakness, an attacker who has successfully authenticated can execute commands that are explicitly denied by the server configuration, effectively nullifying the security boundaries established by system administrators. The core of the issue lies in how the vsftpd daemon processes incoming FTP commands during the post-login phase, where it fails to properly normalize or validate command prefixes before applying access control policies.
The technical root cause is located within the process_post_login function, which handles the cmds_denied list used to block specific operations for restricted users. The implementation performs a literal string comparison between the received command token and the entries in the denied list. However, it fails to account for RFC 775 extensions, specifically those prefixed with X. According to FTP standards, commands starting with an X are aliases that map directly to standard FTP commands; for instance, XRMD maps to RMD (remove directory), XMKD maps to MKD (make directory), XCWD maps to CWD (change working directory), XPWD maps to PWD (print working directory), and XCUP maps to CDUP (change parent). Because the denial check only looks at the literal prefix, sending XRMD is not recognized as RMD by the security filter. Consequently, the server permits these extended commands even when their underlying standard counterparts are strictly prohibited in the configuration file.
The operational impact of this vulnerability allows authenticated attackers to bypass directory restrictions and perform destructive or unauthorized actions within restricted environments. For example, a user confined to a specific read-only area could use XRMD to delete directories outside that scope if they can guess or discover valid paths, or utilize XMKD to create new structures in prohibited locations. This capability compromises the confidentiality, integrity, and availability of data stored on the FTP server. In scenarios where vsftpd is used for public file sharing with limited user accounts, this flaw could allow malicious actors to escalate privileges within the context of the application, potentially leading further exploitation if combined with other vulnerabilities such as buffer overflows or path traversal issues that might exist in older versions of the software.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials related to configuration enforcement failures, although it is more accurately described under CWE-693 Protection Mechanism Failure where the mechanism designed to protect resources fails due to implementation errors. In terms of attack vectors, this falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter if viewed through the lens of executing system commands via FTP aliases, or more precisely T1078 Valid Accounts for maintaining persistence in restricted environments by bypassing intended limitations. The exploitation requires no special privileges beyond valid authentication credentials, making it a straightforward remote code execution vector that does not require user interaction beyond sending crafted network packets.
Mitigation strategies primarily involve upgrading to a patched version of vsftpd where the command parsing logic has been corrected to normalize X-prefixed commands before applying access control checks. Administrators should also consider implementing additional layers of defense such as firewall rules limiting FTP access to trusted IP ranges and employing SFTP or SCP protocols which do not suffer from these legacy protocol ambiguities. Regular auditing of vsftpd configuration files is recommended to ensure that sensitive directories are properly chrooted and that no unnecessary commands remain enabled, even if the specific X-prefix bypass is addressed in newer releases. Monitoring logs for unusual command sequences involving extended FTP aliases can also aid in detecting potential exploitation attempts in real-time environments where immediate patching may not be feasible.