Every CVE Search/ Get API key

CVE-2026-119567

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

2.3 Low

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.22%Unchanged since Oct 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.3

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-184
Updated
2026-11-05
EUVDEUVD-2026-113832 2.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
EUVD-2026-113832
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-9f6m-7pvr-9832 2.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated...

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
GHSA-9f6m-7pvr-9832
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-184
Updated
2026-11-02
NVD 2.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-184
Updated
2026-11-05
OSVDEBIAN-CVE-2026-119567 2.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
DEBIAN-CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-06
OSVUBUNTU-CVE-2026-119567 2.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
UBUNTU-CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-05
OSVAZL-111796 No score

CVE-2026-119567 affecting package vsftpd 3.0.5-1

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
AZL-111796
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vsftpd
Azure Linux:3
 through 3.0.5-1 None known
vsftpd
Debian:12
 All versions, plus listed versions
3.0.3-133.0.3-13.13.0.5-0.13.0.5-0.23.0.5-0.3
Show 5 moreShow less
3.0.5-0.43.0.5-0.53.0.5-0.63.0.5-0.73.0.5-1
 None known
vsftpd
Debian:13
 All versions, plus listed versions
3.0.5-0.23.0.5-0.33.0.5-0.43.0.5-0.53.0.5-0.63.0.5-0.73.0.5-1
 None known
vsftpd
Debian:14
 All versions, plus listed versions
3.0.5-0.23.0.5-0.33.0.5-0.43.0.5-0.53.0.5-0.63.0.5-0.73.0.5-1
 None known
vsftpd
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.0.2-1ubuntu23.0.2-1ubuntu2.14.04.1
 None known
vsftpd
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.0.2-20ubuntu13.0.3-1ubuntu13.0.3-2ubuntu13.0.3-3ubuntu2
 None known
vsftpd
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.3-93.0.3-9build1
 None known
vsftpd
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.3-123.0.5-0ubuntu0.20.04.13.0.5-0ubuntu0.20.04.2
 None known
vsftpd
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.3-13build13.0.3-13build23.0.5-0ubuntu13.0.5-0ubuntu1.1
 None known
vsftpd
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.0.5-0ubuntu13.0.5-0ubuntu23.0.5-0ubuntu33.0.5-0ubuntu3.1
 None known
vsftpd
Ubuntu:26.10
 All versions, plus listed versions
3.0.5-0.43.0.5-0.73.0.5-1build1
 None known
vsftpd
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.5-0.33.0.5-0.4
 None known

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119567 is a low vulnerability (CVSS 2.3) in Vsftpd, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open