Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119364ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass

Medium 5.3

In plain English

A medium-severity security flaw in ProFTPD from ProFTPD Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 59.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23proftpd1.3.9e-r0ALPINE-CVE-2026-119364
Alpine:v3.24proftpd1.3.9e-r0ALPINE-CVE-2026-119364
Debian:12proftpd-dfsgno fix listedDEBIAN-CVE-2026-119364
Debian:13proftpd-dfsgno fix listedDEBIAN-CVE-2026-119364
Debian:14proftpd-dfsg1.3.9e~dfsg-3DEBIAN-CVE-2026-119364
Ubuntu:22.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119364
Ubuntu:24.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119364
Ubuntu:26.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119364
Ubuntu:26.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-119364

Affected products (as reported)

VendorProductVersions
ProFTPD Project ProFTPD 0 – through 1.3.9e1.3.10rc1 – before 1.3.10rc5

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

References