EUVD-2026-113781
GHSA-97rq-x35j-mmf5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged FTP user
-
DeliveryPlant symlink in a writable directory
-
ExploitIssue SITE COPY/CPTO targeting the symlink
-
Executionmod_copy follows link past Limit WRITE
-
ImpactOverwrite file in write-denied location
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires a valid authenticated FTP account (PR:L) and that the server has the contrib mod_copy module loaded, which exposes the SITE COPY and SITE CPTO commands. The attacker must also have write access to at least one directory in which to plant a symlink, and there must be a Limit WRITE restriction whose protected target they aim to overwrite. Limiting factors: exploitation is impossible without credentials, without mod_copy enabled (it is not loaded by default in all deployments), and without a writable directory; impact is confined to overwriting files reachable from the symlink, and no confidentiality or availability impact is indicated. |
| Impact | This is a moderate, not emergency, priority. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N, base 6.0) shows a network-reachable but constrained flaw: it needs a low-privileged authenticated account (PR:L), carries high attack complexity plus an explicit attack requirement (AC:H/AT:P), and yields integrity-only impact (VI:H) with no confidentiality or availability loss. No EPSS probability and no KEV status were provided in the input, so there is no signal of widespread or active exploitation; it is not listed in CISA KEV at time of analysis. A public technical research writeup (abraxaslabs.tech) and the VulnCheck advisory describe the technique, so the mechanism is public, but the input does not confirm packaged working exploit code. The vuln.today decision label is 'this_month', consistent with a real but bounded authenticated authorization-bypass rather than an internet-wide remote-code-execution crisis. Net: patch within the vendor-indicated window; this is a genuine access-control weakness gated by authentication and specific configuration, not a high-CVSS-but-trivial-risk item nor a drop-everything emergency. |
| Exploit ScenarioDerived | A low-privileged but authenticated FTP user on a ProFTPD server with mod_copy loaded places a symlink in a directory they can write to, pointing at a path protected by a Limit WRITE restriction. They then issue SITE COPY or SITE CPTO targeting that symlink; mod_copy resolves the destination without canonicalizing the link and overwrites the write-denied file, bypassing the access control. A public PoC reference (abraxaslabs research writeup) describes this technique; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 allow an authenticated FTP user to overwrite files in write-protected locations by abusing symlink handling in the contrib mod_copy module (SITE COPY and SITE CPTO). Rather than resolving the destination to its real path, mod_copy canonicalized the virtual path, so a symlink planted in a directory the user can write to is followed into a directory guarded by a Limit WRITE restriction, granting integrity impact only (no confidentiality or availability impact) against servers that load mod_copy. Severity is moderate with a high attack complexity (CVSS 4.0 6.0 / CVSS 3.1 6.0, AC:H, PR:L); no CISA KEV entry exists and no verified working exploit code is publicly documented, though a public research writeup describing the technique is referenced, and the vendor fix is available.
RemediationAI
Upgrade to ProFTPD 1.3.10rc5 or later, which contains the fix (release at https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5); deployments staying on the 1.3.9 branch should apply or backport commit c41691f8981f98081fcb8a535c3c21b06a3f04af, which changes mod_copy destination resolution from dir_canonical_vpath() to pr_fs_clear_cache2() plus dir_realpath() with a dir_best_path() fallback. Where server-side copy is not required, building and loading without the contrib mod_copy module removes the SITE COPY/SITE CPTO attack surface entirely, at the cost of losing those commands for users who depend on them. Because exploitation requires an authenticated account with write access to a directory, tightening which accounts receive write permissions, and reviewing Limit WRITE protected paths for symlink-reachable exposure, reduces the set of abusable configurations, but the vendor code change is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mod_copy is an optional ProFTPD contrib module that implements the SITE COPY and SITE CPTO commands for server-side file duplication. In the vulnerable code (contrib/mod_copy.c, copy_copy() around line 620 and copy_cpto() near line 838), the destination path was resolved with dir_canonical_vpath(), which normalizes the virtual path but does not resolve filesystem symlinks. The upstream fix replaces this with pr_fs_clear_cache2() followed by dir_realpath(), falling back to dir_best_path() (the same approach used by xfer_pre_stor()), so the destination is resolved to its real on-disk target and the write-permission checks apply to the actual file rather than to the symlink's location. This is CWE-59 (Improper Link Resolution Before File Access, i.e. link following): the root cause is a path-resolution mismatch between the access-control check and the file operation, not a memory-safety defect. Exploitation depends on deployment specifics - the module must be compiled and loaded, the account must have write access to some directory where the symlink can be planted, and a Limit WRITE rule must protect the intended target; the CVSS AC:H rating reflects these preconditions and the trigger beyond the module and credentials is not further described in the available sources.
Know when Proftpd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Authenticated low-privileged FTP user needing mod_copy enabled and a writable directory gives PR:L and AC:H; impact is file overwrite only, so I:H with C:N and A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseRever
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-pr
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-p
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash
Exploit-DB