Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119147ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

Medium 4.3

In plain English

A medium-severity incorrect authorization in ProFTPD from ProFTPD Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 78.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23proftpd1.3.9e-r0ALPINE-CVE-2026-119147
Alpine:v3.24proftpd1.3.9e-r0ALPINE-CVE-2026-119147
Debian:12proftpd-dfsgno fix listedDEBIAN-CVE-2026-119147
Debian:13proftpd-dfsgno fix listedDEBIAN-CVE-2026-119147
Debian:14proftpd-dfsg1.3.9e~dfsg-1DEBIAN-CVE-2026-119147
Ubuntu:22.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119147
Ubuntu:24.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119147
Ubuntu:26.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119147
Ubuntu:26.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-119147

Affected products (as reported)

VendorProductVersions
ProFTPD Project ProFTPD 0 – before 1.3.9e1.3.10rc1 – before 1.3.10rc5

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References