ProFTPD Access Control Bypass via Path Traversal

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring FTP server logs for the use of the RNFR command with paths prefixed by /proc/self/root, which is unusual and indicative of an attempt to bypass Directory ACL restrictions.

You can use commands to search FTP logs for such RNFR commands. For example, on a Linux system, you might run:

• grep 'RNFR /proc/self/root' /var/log/proftpd/proftpd.log

Additionally, network traffic capture tools like tcpdump or Wireshark can be used to filter FTP commands and look for RNFR commands with the /proc/self/root prefix.

• tcpdump -A -s 0 'tcp port 21 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'RNFR /proc/self/root'

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35025 is an access control bypass vulnerability in ProFTPD versions up to 1.3.9b and 1.3.10rc2. Authenticated FTP users can exploit this flaw by prefixing paths with /proc/self/root in the RNFR command handler. This manipulation exploits unresolved symlink components in the dir_canonical_path() function, causing the dir_check() function to fail to correctly match configured Directory ACL blocks. As a result, attackers can bypass Directory ACL restrictions, allowing unauthorized rename operations on files within directories protected by DenyAll rules and enabling subsequent retrieval of those files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow authenticated FTP users to bypass directory access controls, enabling them to rename and retrieve files in directories that should be protected. This unauthorized access can lead to exposure of sensitive files, potential data leakage, and compromise of file integrity within the affected ProFTPD server.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to configure ProFTPD sessions with DefaultRoot (chroot), which changes the directory to which /proc/self/root resolves, preventing the exploit.

Additionally, updating ProFTPD to a version later than 1.3.9b and 1.3.10rc2 where this vulnerability is fixed is recommended.

Until an update can be applied, monitoring and restricting authenticated FTP users' ability to use the RNFR command with suspicious path prefixes can help reduce risk.

Useful 0 Not Useful 0