ProFTPD CVE-2026-35025

Requires an authenticated low-privilege FTP account (CVSS PR:L) on a ProFTPD instance that is NOT using DefaultRoot/chroot, and the target files must reside in directories governed by <Directory> ACLs (e.g., DenyAll) that the attacker is otherwise denied. The exact trigger is supplying a path prefixed with /proc/self/root to the RNFR command handler so that dir_canonical_path() leaves the symlink component unresolved and dir_check() performs a lexical comparison that matches no configured Directory block. Limiting factors: sessions configured with DefaultRoot (chroot) are explicitly unaffected; exploitation is confined to platforms exposing a /proc/self/root magic symlink (Linux-style procfs); and valid credentials plus an ACL-protected target path are mandatory, so default single-user or fully-chrooted deployments are not exposed.

Signals are moderately concordant and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:N) indicates network reach, low complexity, no user interaction, and high confidentiality/integrity impact, but PR:L means a valid FTP login is a hard prerequisite - this is not an unauthenticated internet-wide threat. There is no CISA KEV listing and no public POC identified, so there is no evidence of active or widespread exploitation; EPSS was not provided in the input and cannot be cited. The most important limiting factor is explicit in the description: sessions using DefaultRoot (chroot) are not affected because chroot changes what /proc/self/root resolves to, so any environment that already chroots FTP users is out of scope. Net assessment: prioritize for environments running non-chrooted ProFTPD with multi-user accounts and Directory-based ACLs; deprioritize where DefaultRoot/chroot is already enforced.

An attacker who holds or obtains a low-privilege FTP account logs into a non-chrooted ProFTPD server, then issues RNFR with a path such as /proc/self/root/etc/secret/data to rename a file living in a DenyAll-protected <Directory>, followed by RNTO into a location they can read, and finally retrieves it. Because attack complexity is low and no user interaction is needed, the sequence can be scripted once valid credentials are available; no public POC is identified at time of analysis.