Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by ProFTPD Project
CVE-2026-119364 (GCVE-0-2026-119364)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass
Summary
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/issues/2374 | issue-tracking |
| https://github.com/proftpd/proftpd/commit/c41691f… | patch |
| https://github.com/proftpd/proftpd/blob/v1.3.9e/c… | technical-description |
| https://github.com/proftpd/proftpd/releases/tag/v… | release-notes |
| https://abraxaslabs.tech/research/proftpd-site-co… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| https://www.vulncheck.com/advisories/proftpd-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , ≤ 1.3.9e
(custom)
Affected: 1.3.10rc1 , < 1.3.10rc5 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:52.024825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:45.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThanOrEqual": "1.3.9e",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.10rc5",
"status": "affected",
"version": "1.3.10rc1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3.9e",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.10rc5",
"versionStartIncluding": "1.3.10rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "TJ Saunders"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:37.047Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/proftpd/proftpd/issues/2374"
},
{
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/blob/v1.3.9e/contrib/mod_copy.c#L620"
},
{
"name": "ProFTPD v1.3.10rc5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/proftpd-site-copy-dest-follow"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "VulnCheck Advisory: ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-through-1.3-9e-and-1.3-10rc4-mod-copy-symlink-following-write-bypass"
}
],
"title": "ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119364",
"datePublished": "2026-10-30T11:30:37.047Z",
"dateReserved": "2026-10-30T00:26:48.481Z",
"dateUpdated": "2026-10-30T15:56:45.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119147 (GCVE-0-2026-119147)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass
Summary
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/commit/b7d3de4… | patch |
| https://github.com/proftpd/proftpd/blob/v1.3.9d/c… | technical-description |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.9e | release-notes |
| https://github.com/proftpd/proftpd/releases/tag/v… | release-notes |
| https://abraxaslabs.tech/research/proftpd-sftp-co… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| https://www.vulncheck.com/advisories/proftpd-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , < 1.3.9e
(custom)
Affected: 1.3.10rc1 , < 1.3.10rc5 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThan": "1.3.9e",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.10rc5",
"status": "affected",
"version": "1.3.10rc1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.9e",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.10rc5",
"versionStartIncluding": "1.3.10rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "finder",
"value": "MiniMax Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "TJ Saunders"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:36.342Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748"
},
{
"name": "ProFTPD v1.3.9e Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e"
},
{
"name": "ProFTPD v1.3.10rc5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass"
}
],
"title": "ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119147",
"datePublished": "2026-10-30T11:30:36.342Z",
"dateReserved": "2026-10-29T14:28:41.595Z",
"dateUpdated": "2026-10-30T11:30:36.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119146 (GCVE-0-2026-119146)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap
Summary
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Severity
5.6 (Medium)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/commit/502d280… | patch |
| https://github.com/proftpd/proftpd/blob/v1.3.9d/c… | technical-description |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.9e | release-notes |
| https://github.com/proftpd/proftpd/releases/tag/v… | release-notes |
| https://abraxaslabs.tech/research/proftpd-rewrite… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| https://www.vulncheck.com/advisories/proftpd-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , < 1.3.9e
(custom)
Affected: 1.3.10rc1 , < 1.3.10rc5 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThan": "1.3.9e",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.10rc5",
"status": "affected",
"version": "1.3.10rc1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.9e",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.10rc5",
"versionStartIncluding": "1.3.10rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bruno Henc"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "TJ Saunders"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:35.628Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_rewrite.c#L2052"
},
{
"name": "ProFTPD v1.3.9e Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e"
},
{
"name": "ProFTPD v1.3.10rc5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-buffer-overflow-via-mod-rewrite-utf8trans-rewritemap"
}
],
"title": "ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119146",
"datePublished": "2026-10-30T11:30:35.628Z",
"dateReserved": "2026-10-29T14:28:41.595Z",
"dateUpdated": "2026-10-30T11:30:35.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53994 (GCVE-0-2026-53994)
Vulnerability from nvd – Published: 2026-07-18 19:30 – Updated: 2026-07-28 01:49
VLAI
EPSS
VEX
Title
ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
Summary
ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 19:12 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd | product |
| https://github.com/proftpd/proftpd/commit/7342836… | patch |
| https://www.vulncheck.com/advisories/proftpd-mod-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , < 1.3.10
(git)
cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-07-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T19:12:38.278628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T19:13:48.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "ProFTPD",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThan": "1.3.10",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "devnull445"
}
],
"datePublic": "2026-07-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:40.378Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Product",
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/7342836fa98e36209660a4c5805c801476f63936"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-unsigned-integer-underflow-and-size-truncation"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-53994",
"datePublished": "2026-07-18T19:30:32.740Z",
"dateReserved": "2026-06-11T16:07:13.001Z",
"dateUpdated": "2026-07-28T01:49:40.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35025 (GCVE-0-2026-35025)
Vulnerability from nvd – Published: 2026-06-24 13:21 – Updated: 2026-07-14 20:00 X_Open Source
VLAI
EPSS
VEX
Title
ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR
Summary
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-24 15:00 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/issues/2170 | technical-description |
| http://www.proftpd.org/ | product |
| https://www.vulncheck.com/advisories/proftpd-acl-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , ≤ 1.3.9b
(custom)
Affected: 0 , ≤ 1.3.10rc2 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-06-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35025",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-24T15:00:28.448881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:01:06.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThanOrEqual": "1.3.9b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.3.10rc2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3.9b",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "djnn"
},
{
"lang": "en",
"type": "finder",
"value": "VulnCheck"
}
],
"datePublic": "2026-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T20:00:11.517Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/issues/2170"
},
{
"tags": [
"product"
],
"url": "http://www.proftpd.org/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-35025",
"datePublished": "2026-06-24T13:21:42.281Z",
"dateReserved": "2026-03-31T20:40:15.618Z",
"dateUpdated": "2026-07-14T20:00:11.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2010-20103 (GCVE-0-2010-20103)
Vulnerability from nvd – Published: 2025-08-20 15:38 – Updated: 2026-07-15 01:23 X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
ProFTPD 1.3.3c Backdoor Command Execution
Summary
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-22 15:44 UTC
CWE
- CWE-912 - Hidden Functionality
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://web.archive.org/web/20111107212129/http:/… | vendor-advisorypatch |
| https://raw.githubusercontent.com/rapid7/metasplo… | exploit |
| https://www.exploit-db.com/exploits/15662 | exploit |
| https://www.exploit-db.com/exploits/16921 | exploit |
| https://advisories.checkpoint.com/defense/advisor… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| http://www.proftpd.org/ | product |
| https://www.vulncheck.com/advisories/proftpd-back… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD (Professional FTP Daemon) |
Affected:
1.3.3c
cpe:2.3:a:proftpd:proftpd:1.3.3c:*:*:*:*:*:*:* |
Date Public
2010-12-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2010-20103",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T15:44:16.891816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T15:44:20.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/16921"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/15662"
},
{
"tags": [
"exploit"
],
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"core daemon"
],
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD (Professional FTP Daemon)",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"status": "affected",
"version": "1.3.3c"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.3c:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2010-12-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.\u003c/p\u003e"
}
],
"value": "A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:23:11.729Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/"
},
{
"tags": [
"exploit"
],
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/15662"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/16921"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"tags": [
"product"
],
"url": "http://www.proftpd.org/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-backdoor-command-execution"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "ProFTPD 1.3.3c Backdoor Command Execution",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2010-20103",
"datePublished": "2025-08-20T15:38:46.697Z",
"dateReserved": "2025-08-19T16:00:37.400Z",
"dateUpdated": "2026-07-15T01:23:11.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119364 (GCVE-0-2026-119364)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass
Summary
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/issues/2374 | issue-tracking |
| https://github.com/proftpd/proftpd/commit/c41691f… | patch |
| https://github.com/proftpd/proftpd/blob/v1.3.9e/c… | technical-description |
| https://github.com/proftpd/proftpd/releases/tag/v… | release-notes |
| https://abraxaslabs.tech/research/proftpd-site-co… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| https://www.vulncheck.com/advisories/proftpd-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , ≤ 1.3.9e
(custom)
Affected: 1.3.10rc1 , < 1.3.10rc5 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:52.024825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:45.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThanOrEqual": "1.3.9e",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.10rc5",
"status": "affected",
"version": "1.3.10rc1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3.9e",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.10rc5",
"versionStartIncluding": "1.3.10rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "TJ Saunders"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:37.047Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/proftpd/proftpd/issues/2374"
},
{
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/blob/v1.3.9e/contrib/mod_copy.c#L620"
},
{
"name": "ProFTPD v1.3.10rc5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/proftpd-site-copy-dest-follow"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "VulnCheck Advisory: ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-through-1.3-9e-and-1.3-10rc4-mod-copy-symlink-following-write-bypass"
}
],
"title": "ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119364",
"datePublished": "2026-10-30T11:30:37.047Z",
"dateReserved": "2026-10-30T00:26:48.481Z",
"dateUpdated": "2026-10-30T15:56:45.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119147 (GCVE-0-2026-119147)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass
Summary
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/commit/b7d3de4… | patch |
| https://github.com/proftpd/proftpd/blob/v1.3.9d/c… | technical-description |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.9e | release-notes |
| https://github.com/proftpd/proftpd/releases/tag/v… | release-notes |
| https://abraxaslabs.tech/research/proftpd-sftp-co… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| https://www.vulncheck.com/advisories/proftpd-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , < 1.3.9e
(custom)
Affected: 1.3.10rc1 , < 1.3.10rc5 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThan": "1.3.9e",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.10rc5",
"status": "affected",
"version": "1.3.10rc1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.9e",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.10rc5",
"versionStartIncluding": "1.3.10rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "finder",
"value": "MiniMax Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "TJ Saunders"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:36.342Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748"
},
{
"name": "ProFTPD v1.3.9e Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e"
},
{
"name": "ProFTPD v1.3.10rc5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass"
}
],
"title": "ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119147",
"datePublished": "2026-10-30T11:30:36.342Z",
"dateReserved": "2026-10-29T14:28:41.595Z",
"dateUpdated": "2026-10-30T11:30:36.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119146 (GCVE-0-2026-119146)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap
Summary
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Severity
5.6 (Medium)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/commit/502d280… | patch |
| https://github.com/proftpd/proftpd/blob/v1.3.9d/c… | technical-description |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.9e | release-notes |
| https://github.com/proftpd/proftpd/releases/tag/v… | release-notes |
| https://abraxaslabs.tech/research/proftpd-rewrite… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| https://www.vulncheck.com/advisories/proftpd-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , < 1.3.9e
(custom)
Affected: 1.3.10rc1 , < 1.3.10rc5 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThan": "1.3.9e",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.10rc5",
"status": "affected",
"version": "1.3.10rc1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.9e",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.10rc5",
"versionStartIncluding": "1.3.10rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bruno Henc"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "TJ Saunders"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:35.628Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_rewrite.c#L2052"
},
{
"name": "ProFTPD v1.3.9e Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e"
},
{
"name": "ProFTPD v1.3.10rc5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-buffer-overflow-via-mod-rewrite-utf8trans-rewritemap"
}
],
"title": "ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119146",
"datePublished": "2026-10-30T11:30:35.628Z",
"dateReserved": "2026-10-29T14:28:41.595Z",
"dateUpdated": "2026-10-30T11:30:35.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53994 (GCVE-0-2026-53994)
Vulnerability from cvelistv5 – Published: 2026-07-18 19:30 – Updated: 2026-07-28 01:49
VLAI
EPSS
VEX
Title
ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
Summary
ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 19:12 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd | product |
| https://github.com/proftpd/proftpd/commit/7342836… | patch |
| https://www.vulncheck.com/advisories/proftpd-mod-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , < 1.3.10
(git)
cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-07-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T19:12:38.278628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T19:13:48.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "ProFTPD",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThan": "1.3.10",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "devnull445"
}
],
"datePublic": "2026-07-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:40.378Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Product",
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/proftpd/proftpd/commit/7342836fa98e36209660a4c5805c801476f63936"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-unsigned-integer-underflow-and-size-truncation"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-53994",
"datePublished": "2026-07-18T19:30:32.740Z",
"dateReserved": "2026-06-11T16:07:13.001Z",
"dateUpdated": "2026-07-28T01:49:40.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35025 (GCVE-0-2026-35025)
Vulnerability from cvelistv5 – Published: 2026-06-24 13:21 – Updated: 2026-07-14 20:00 X_Open Source
VLAI
EPSS
VEX
Title
ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR
Summary
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-24 15:00 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/proftpd/proftpd/issues/2170 | technical-description |
| http://www.proftpd.org/ | product |
| https://www.vulncheck.com/advisories/proftpd-acl-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD |
Affected:
0 , ≤ 1.3.9b
(custom)
Affected: 0 , ≤ 1.3.10rc2 (custom) cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
Date Public
2026-06-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35025",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-24T15:00:28.448881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:01:06.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"lessThanOrEqual": "1.3.9b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.3.10rc2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3.9b",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "djnn"
},
{
"lang": "en",
"type": "finder",
"value": "VulnCheck"
}
],
"datePublic": "2026-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T20:00:11.517Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/proftpd/proftpd/issues/2170"
},
{
"tags": [
"product"
],
"url": "http://www.proftpd.org/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-35025",
"datePublished": "2026-06-24T13:21:42.281Z",
"dateReserved": "2026-03-31T20:40:15.618Z",
"dateUpdated": "2026-07-14T20:00:11.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2010-20103 (GCVE-0-2010-20103)
Vulnerability from cvelistv5 – Published: 2025-08-20 15:38 – Updated: 2026-07-15 01:23 X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
ProFTPD 1.3.3c Backdoor Command Execution
Summary
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-22 15:44 UTC
CWE
- CWE-912 - Hidden Functionality
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://web.archive.org/web/20111107212129/http:/… | vendor-advisorypatch |
| https://raw.githubusercontent.com/rapid7/metasplo… | exploit |
| https://www.exploit-db.com/exploits/15662 | exploit |
| https://www.exploit-db.com/exploits/16921 | exploit |
| https://advisories.checkpoint.com/defense/advisor… | third-party-advisory |
| https://github.com/proftpd/proftpd | product |
| http://www.proftpd.org/ | product |
| https://www.vulncheck.com/advisories/proftpd-back… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProFTPD Project | ProFTPD (Professional FTP Daemon) |
Affected:
1.3.3c
cpe:2.3:a:proftpd:proftpd:1.3.3c:*:*:*:*:*:*:* |
Date Public
2010-12-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2010-20103",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T15:44:16.891816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T15:44:20.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/16921"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/15662"
},
{
"tags": [
"exploit"
],
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"core daemon"
],
"packageURL": "pkg:github/proftpd/proftpd",
"product": "ProFTPD (Professional FTP Daemon)",
"repo": "https://github.com/proftpd/proftpd",
"vendor": "ProFTPD Project",
"versions": [
{
"status": "affected",
"version": "1.3.3c"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.3c:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2010-12-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.\u003c/p\u003e"
}
],
"value": "A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:23:11.729Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/"
},
{
"tags": [
"exploit"
],
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/15662"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/16921"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/"
},
{
"tags": [
"product"
],
"url": "https://github.com/proftpd/proftpd"
},
{
"tags": [
"product"
],
"url": "http://www.proftpd.org/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/proftpd-backdoor-command-execution"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "ProFTPD 1.3.3c Backdoor Command Execution",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2010-20103",
"datePublished": "2025-08-20T15:38:46.697Z",
"dateReserved": "2025-08-19T16:00:37.400Z",
"dateUpdated": "2026-07-15T01:23:11.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}