ProFTPD up to 1.3.9b/1.3.10rc2 RNFR Command dir_canonical_path link following

Summaryinfo

A vulnerability, which was classified as critical, was found in ProFTPD up to 1.3.9b/1.3.10rc2. Affected by this issue is the function dir_canonical_path of the component RNFR Command Handler. The manipulation results in link following. This vulnerability is reported as CVE-2026-35025. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in ProFTPD up to 1.3.9b/1.3.10rc2. Affected is the function dir_canonical_path of the component RNFR Command Handler. The manipulation with an unknown input leads to a link following vulnerability. CWE is classifying the issue as CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.

The weakness was disclosed by djnn. The advisory is available at github.com. This vulnerability is traded as CVE-2026-35025 since 03/31/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• File Transfer Software

Name

• ProFTPD

Version

• 1.3.9a
• 1.3.9b
• 1.3.10rc1
• 1.3.10rc2

License

• open-source

Website

• Product: https://github.com/proftpd/proftpd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion