ProFTPD EUVD-2026-113780

Requires an authenticated SFTP session on a ProFTPD server running mod_sftp with the SFTP copy-file extension handler reachable, where <Limit WRITE> rules are the mechanism enforcing where authenticated users may create files. The attacker must have read access to some source file and a target directory in which writes are denied by <Limit WRITE>. Exploitation is LIMITED by the need for valid SFTP credentials (PR:L), the requirement that the deployment actually uses mod_sftp and relies on <Limit> for write segregation (servers that do not use <Limit WRITE> to restrict uploads gain nothing for an attacker to bypass), and by the fact that impact is confined to creating new destination files - no overwrite of existing files or execution is granted.

This is a medium-severity authorization bypass (CWE-863) with modest real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privilege SFTP user, no user interaction, and limited to a low integrity impact (VI:L) with no confidentiality or availability effect. The flaw does not grant code execution, data theft, or privilege escalation - it only lets an already-authenticated user write files into directories that <Limit WRITE> was configured to deny, so the practical impact is confined to environments that depend on <Limit> rules to partition authenticated users. No CISA KEV listing is present and no EPSS score was supplied, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-non-urgent priority. The vulnerability was reported by VulnCheck and a vendor code fix is confirmed (commit b7d3de4). Overall this is a legitimate access-control defect to patch on a normal monthly cycle rather than a drop-everything emergency, and the low CVSS reflects the genuine impact rather than overstating it. Note: no EPSS, KEV, or confirmed exploit-code status was provided in the input, so exploitation likelihood is inferred only from the decision label and the authenticated/low-impact profile.

An attacker who already holds valid SFTP credentials on a ProFTPD server that relies on <Limit WRITE> to forbid uploads to certain directories invokes the SFTP copy-file extension to duplicate a file they can read into one of those write-denied paths. Because the destination-file authorization check was skipped, the server creates the file despite the <Limit WRITE> restriction. Exploitation is remote and low-complexity but requires authentication (PR:L); a research write-up describing the flaw is public, though no verified working exploit code is confirmed in the input.