Every CVESearch/Get API key

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

5.3 MediumFix available

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.29%Unchanged since Oct 31, 2026
90%50%10%1%

What each source reports

CVE List Score used5.3

ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
CVE-2026-119147
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-05
EUVDEUVD-2026-1137805.3

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
EUVD-2026-113780
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-24hg-mwfp-6pwj5.3

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file...

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
GHSA-24hg-mwfp-6pwj
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD5.3

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
CVE-2026-119147
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-05
OSVALPINE-CVE-2026-1191475.3

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
ALPINE-CVE-2026-119147
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-06
OSV5.3

ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
CVE-2026-119147
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-07
Show 4 moreShow less
OSVDEBIAN-CVE-2026-1191475.3

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
DEBIAN-CVE-2026-119147
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-06
OSVUBUNTU-CVE-2026-1191475.3

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Record
UBUNTU-CVE-2026-119147
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-05
OSVopenSUSE-SU-2026:12438-1No score

proftpd-1.3.9e-1.1 on GA media

These are all security issues fixed in the proftpd-1.3.9e-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12438-1
Updated
2026-11-06
OSVSUSE-SU-2026:5181-1No score

Security update for proftpd

This update for proftpd fixes the following issues:

  • Authenticated SFTP sessions can overflow the SFTP packet buffer (bsc#1271096).
  • CVE-2026-35025: access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler (bsc#1269065).
  • CVE-2026-42167: mod_sql allows remote attackers to execute arbitrary code via a username when there is logging of USER requests with an expansion such as %U and the SQL backend allows comman (bsc#1263183).
  • CVE-2026-44331: SQL injection in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c triggered via crafted domain name from reverse DNS lookup (bsc#1264262).
  • CVE-2026-53994: heap-based buffer overflow reachable by an authenticated SFTP user can lead to denial of service and memory corruption (bsc#1271946).
  • CVE-2026-63090: heap-based buffer overflow in the mod_sftp module can lead to arbitrary code execution via crafted SFTP packet fragments (bsc#1271944).
  • CVE-2026-63091: signed integer overflow in the mod_sftp module's SCP size-record parser can lead to ASLR bypass via a crafted file size value of UINT64_MAX (bsc#1271945).
  • CVE-2026-119147: authorization bypass in the mod_sftp copy-file extension handler allows SFTP users to copy any readable file to a new path in write-denied directories (bsc#1289272).
  • Integer overflow via client-provided file size for SCP uploads (bsc#1271097).
Record
SUSE-SU-2026:5181-1
Updated
2026-11-11

Affected products

Affected packages

Affected packages
PackageAffectedFixed
proftpd
Alpine:v3.23
before 1.3.9e-r0
1.3.9e-r0
proftpd
Alpine:v3.24
before 1.3.9e-r0
1.3.9e-r0
proftpd-dfsg
Debian:12
All versions, plus listed versions
1.3.8+dfsg-41.3.8+dfsg-4+deb12u11.3.8+dfsg-4+deb12u21.3.8+dfsg-4+deb12u31.3.8+dfsg-4+deb12u4
Show 26 moreShow less
1.3.8+dfsg-4+deb12u51.3.8+dfsg-51.3.8+dfsg-61.3.8+dfsg-71.3.8+dfsg-81.3.8.a+dfsg-11.3.8.b+dfsg-11.3.8.b+dfsg-21.3.8.b+dfsg-31.3.8.b+dfsg-41.3.8.c+dfsg-11.3.8.c+dfsg-21.3.8.c+dfsg-31.3.8.c+dfsg-41.3.9a~dfsg-11.3.9b~dfsg-11.3.9c~dfsg-11.3.9d~dfsg-11.3.9e~dfsg-11.3.9e~dfsg-21.3.9e~dfsg-31.3.9~dfsg-11.3.9~dfsg-21.3.9~dfsg-31.3.9~dfsg-41.3.9~dfsg-5
None known
proftpd-dfsg
Debian:13
All versions, plus listed versions
1.3.8.c+dfsg-41.3.8.c+dfsg-4+deb13u11.3.8.c+dfsg-4+deb13u21.3.8.c+dfsg-4+deb13u31.3.9a~dfsg-1
Show 11 moreShow less
1.3.9b~dfsg-11.3.9c~dfsg-11.3.9d~dfsg-11.3.9e~dfsg-11.3.9e~dfsg-21.3.9e~dfsg-31.3.9~dfsg-11.3.9~dfsg-21.3.9~dfsg-31.3.9~dfsg-41.3.9~dfsg-5
None known
proftpd-dfsg
Debian:14
before 1.3.9e~dfsg-1, plus listed versions
1.3.8.c+dfsg-41.3.9a~dfsg-11.3.9b~dfsg-11.3.9c~dfsg-11.3.9d~dfsg-1
Show 5 moreShow less
1.3.9~dfsg-11.3.9~dfsg-21.3.9~dfsg-31.3.9~dfsg-41.3.9~dfsg-5
1.3.9e~dfsg-1
proftpd
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 7 CVEs
before 1.3.8b-150600.13.18.1
1.3.8b-150600.13.18.1
proftpd
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
before 1.3.8b-150600.13.18.1
1.3.8b-150600.13.18.1
proftpd
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
before 1.3.8b-150600.13.18.1
1.3.8b-150600.13.18.1
proftpd-dfsg
Ubuntu:16.04:LTS
All versions, plus listed versions
1.3.5-21.3.5a-11.3.5a-1build11.3.5a-1ubuntu0.1
None known
proftpd-dfsg
Ubuntu:18.04:LTS
All versions, plus listed versions
1.3.5d-11.3.5e-1build1
None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
proftpd-dfsg
Ubuntu:20.04:LTS
All versions, plus listed versions
1.3.6-6build21.3.6c-11.3.6c-21.3.6c-2ubuntu0.1
None known
proftpd-dfsg
Ubuntu:22.04:LTS
All versions, plus listed versions
1.3.7b+dfsg-11.3.7c+dfsg-1build11.3.7c+dfsg-1ubuntu0.1
None known
proftpd-dfsg
Ubuntu:24.04:LTS
All versions, plus listed versions
1.3.8+dfsg-81.3.8.a+dfsg-11.3.8.b+dfsg-11.3.8.b+dfsg-1build11.3.8.b+dfsg-1build21.3.8.b+dfsg-1build31.3.8.b+dfsg-1ubuntu0.1
None known
proftpd-dfsg
Ubuntu:26.10
All versions, plus listed versions
1.3.9~dfsg-41.3.9b~dfsg-11.3.9d~dfsg-1
None known
proftpd-dfsg
Ubuntu:26.04:LTS
All versions, plus listed versions
1.3.9~dfsg-31.3.9~dfsg-4
None known
proftpd
openSUSE:Tumbleweed
before 1.3.9e-1.1
1.3.9e-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesCVE List, EUVD, NVD, OSV
affectedOSV
affected, aliases, facts, referencesOSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119147 is a medium vulnerability (CVSS 5.3) in Proftpd, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in proftpd 1.3.9e-r0.

References

Show 25 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open