CVE-2026-119364
Received Received - Intake

Authenticated FTP Symlink Bypass in ProFTPD

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119364
EUVD
EUVD-2026-113781

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ProFTPD Project ProFTPD 0
ProFTPD Project ProFTPD 1.3.10rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119364 is a vulnerability in ProFTPD's mod_copy module affecting versions through 1.3.9e and 1.3.10rc1 to 1.3.10rc4. It allows authenticated FTP users to bypass Limit WRITE restrictions by creating a symlink in a writable directory pointing to a protected file. Using SITE COPY or SITE CPTO commands, the symlink's target is not resolved, letting users overwrite files that should be write-protected.

Detection Guidance

To detect this vulnerability, check if ProFTPD versions through 1.3.9e or 1.3.10rc1 to 1.3.10rc4 are running. Use commands like 'proftpd -v' or 'rpm -qa | grep proftpd' to verify the version. Monitor FTP logs for unusual SITE COPY or SITE CPTO commands involving symlinks.

Impact Analysis

This vulnerability could allow attackers with FTP access to overwrite critical system files or sensitive data by bypassing write restrictions. It may lead to unauthorized modifications, data corruption, or system compromise. Organizations using vulnerable ProFTPD versions risk unauthorized file changes and potential data breaches.

Mitigation Strategies

Upgrade ProFTPD to version 1.3.10rc5 or later, which includes the fix for this issue. If upgrading is not immediately possible, disable the mod_copy module by removing or commenting out 'LoadModule mod_copy.c' in the ProFTPD configuration file. Restrict FTP user permissions to minimize potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119364. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart