EUVD-2026-38789
GHSA-9vr4-2f43-pc8v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable FTP service with low complexity but requires a valid low-privilege account (PR:L); enables reading and renaming protected files (C:H/I:H), no availability impact, no scope change.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
AnalysisAI
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-protected directories by prefixing paths with /proc/self/root in the RNFR (rename-from) command. Because the CVSS 4.0 vector specifies PR:L, exploitation requires a valid low-privilege FTP account, after which an attacker can rename and then retrieve files that configured Directory ACLs were meant to protect. There is no public exploit identified at time of analysis and no KEV listing, but the VulnCheck-assessed CVSS of 8.6 reflects the strong confidentiality and integrity impact on file-access controls.
Technical ContextAI
ProFTPD is a widely used, modular open-source FTP/FTPS daemon for Unix-like systems whose access model relies on <Directory> blocks and Limit/DenyAll rules evaluated per request. The flaw is a CWE-59 (link/path-resolution) issue: dir_canonical_path() does not fully resolve symlink components such as the /proc/self/root magic symlink, so a path like /proc/self/root/<target> is passed to dir_check() with unresolved components. dir_check() then performs a lexical (string) comparison that matches none of the configured Directory blocks, so the request silently escapes the ACL that should govern the real target path. On Linux, /proc/self/root resolves to the process root, which for a non-chrooted ProFTPD session is the actual filesystem root, allowing the prefixed path to alias protected locations.
RemediationAI
No vendor-released patch version is identified at time of analysis - the upstream item is GitHub issue https://github.com/proftpd/proftpd/issues/2170, not a tagged release - so monitor that issue, the ProFTPD project (http://www.proftpd.org/), and the VulnCheck advisory (https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr) for a fixed build and upgrade once published. The most effective immediate compensating control is the vendor-stated mitigation: configure DefaultRoot to chroot FTP sessions, which neutralizes the bypass because chroot changes what /proc/self/root resolves to (trade-off: chrooted users lose visibility and access to paths outside their root, which may break legitimate cross-directory workflows and require per-group DefaultRoot tuning). Where chroot is not feasible, reduce exposure by minimizing the number of authenticated FTP accounts, restricting which users can issue rename operations, and ensuring sensitive data is not merely ACL-hidden under a non-chrooted tree; on Linux, restricting /proc visibility for the FTP service context can also break the /proc/self/root alias but may interfere with other process functionality.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseRever
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-pr
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile direct
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today