EUVD-2026-45960
GHSA-wxc2-grp8-f55h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SFTP with low-complexity deterministic reassembly trigger requiring only a valid low-privilege account (PR:L), no UI; code execution yields full C/I/A impact with unchanged scope.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
AnalysisAI
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-privilege SFTP users to run code in the server process by abusing SFTP packet reassembly in fxp.c. The flaw stems from an incorrectly conditioned reallocation of the 16 KB reassembly buffer that corrupts memory-pool freelist metadata, ultimately hijacking pr_fsio_stat() to reach system(). Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the advisory describes a complete exploitation primitive.
Technical ContextAI
ProFTPD is a widely used open-source FTP daemon; the affected component is its mod_sftp module, which implements the SSH File Transfer Protocol (SFTP) over an SSH transport. The root cause is CWE-122 (heap-based buffer overflow): when an SFTP client streams a logical packet as multiple fragments, mod_sftp reassembles them into a fixed 16 KB buffer, and oversized fragments trigger a mis-sized reallocation. Because ProFTPD manages memory through its own pool allocator, the overflow corrupts pool freelist metadata rather than a simple stack frame, letting an attacker overwrite the root_fs pointer in the BSS segment so it references an attacker-controlled fake pr_fs_t filesystem structure. A subsequent RENAME request routes pr_fsio_stat() through the forged struct's function pointer into system(), converting heap corruption into command execution. The affected CPE is cpe:2.3:a:proftpd:proftpd covering all versions prior to the fixed releases.
RemediationAI
Vendor-released patch: upgrade to ProFTPD 1.3.9c (stable) or 1.3.10rc3-3 (release-candidate line), which contain fix commit 4ee8701bcf425f11b3b2116e634ff3e655d918b1; see the release notes at https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES and issue https://github.com/proftpd/proftpd/issues/2190. If immediate patching is not possible, the most direct compensating control is to disable mod_sftp (remove the SFTPEngine on directive / unload the module) and fall back to FTPS or a separate hardened SFTP endpoint, at the cost of losing SSH-based file transfer on that server. Where SFTP must stay enabled, restrict who can reach it - bind the service to internal interfaces, front it with network ACLs or a VPN, and remove or audit low-privilege accounts - recognizing this reduces but does not eliminate risk since any valid low-privilege user can still trigger the flaw. Full details are in the VulnCheck advisory at https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseRever
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-p
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile direct
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today