Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by VulnCheck

CVE-2026-35025ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR

High 8.1

In plain English

A high-severity security flaw in ProFTPD from ProFTPD Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 56.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12proftpd-dfsgno fix listedDEBIAN-CVE-2026-35025
Debian:13proftpd-dfsgno fix listedDEBIAN-CVE-2026-35025
Debian:14proftpd-dfsgno fix listedDEBIAN-CVE-2026-35025
Ubuntu:22.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-35025
Ubuntu:24.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-35025
Ubuntu:25.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-35025
Ubuntu:26.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-35025
Ubuntu:26.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-35025

Affected products (as reported)

VendorProductVersions
ProFTPD Project ProFTPD 0 – through 1.3.9b0 – through 1.3.10rc2

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References