ProFTPD CVE-2026-63090

Requires a valid authenticated low-privilege SFTP login (PR:L) to a ProFTPD server built with the mod_sftp module enabled (SFTPEngine active) and reachable over the network - the attack targets the SFTP packet-reassembly path in fxp.c. Exploitation is performed by sending SFTP packet fragments whose reassembled size exceeds the 16 KB buffer, then a crafted RENAME operation to redirect pr_fsio_stat() into system(). Limiting factors: authentication is mandatory (no anonymous/unauthenticated path in the data), the server must expose SFTP rather than only plain FTP/FTPS, and the target must be an unpatched version (before 1.3.9c / 1.3.10rc3); no user interaction and no high privileges are needed once credentials are held.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact and no scope change to subsequent systems - consistent with code execution inside the ProFTPD process. The critical limiting factor is PR:L: an attacker needs valid SFTP credentials, so this is not an unauthenticated internet-wide scenario but is highly relevant anywhere low-trust users receive SFTP accounts (shared hosting, managed file transfer, SFTP drop boxes). No EPSS score, SSVC decision, or CISA KEV entry is present in the input, so exploitation probability cannot be quantified and active exploitation is not confirmed. The VulnCheck advisory documents a full, deterministic exploitation chain, which raises practical exploitability above a typical memory-corruption bug even though no packaged public POC is confirmed. Net: a genuine priority for multi-tenant SFTP deployments, moderate priority where all SFTP users are trusted.

An attacker holding any valid low-privilege SFTP account (for example on a shared-hosting or managed-file-transfer server) opens an SFTP session and streams a logical packet in fragments whose combined size exceeds the 16 KB reassembly buffer, corrupting the pool freelist and overwriting the root_fs global. They then issue a crafted RENAME request that drives pr_fsio_stat() through their fake filesystem struct into system(), executing shell commands with the privileges of the ProFTPD process. The VulnCheck advisory documents this end-to-end chain; no packaged public exploit is confirmed in the provided data.