CVE-2026-119567
Received Received - Intake

Authenticated FTP Command Bypass in vsftpd

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119567
EUVD
EUVD-2026-113832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vsftpd vsftpd 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

vsftpd through 3.0.5 has an access control bypass flaw where authenticated FTP users can bypass command restrictions by sending RFC 775 X-prefixed aliases like XRMD, XMKD, XCWD, XPWD, or XCUP. The system checks for denied commands using literal tokens, allowing attackers to perform blocked operations such as deleting directories.

Detection Guidance

Check vsftpd version with 'vsftpd -v' or 'rpm -qa | grep vsftpd'. Monitor FTP logs for X-prefixed commands like XRMD, XMKD, XCWD, XPWD, or XCUP. Test with authenticated FTP access to see if these commands bypass restrictions.

Impact Analysis

An attacker with valid FTP credentials could delete directories, modify directory structures, or access restricted paths on the server. This could lead to data loss, unauthorized file manipulation, or disruption of services relying on the FTP server.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized directory deletions or modifications may lead to data breaches or loss of audit trails.

Mitigation Strategies

Upgrade vsftpd to version 3.0.6 or later. Disable X-prefixed commands in FTP server configuration. Restrict FTP access to trusted users only. Monitor for unusual FTP activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart