Every CVESearch/Get API key

CVE-2026-119567

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

2.3 Low

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.22%Unchanged since Oct 31, 2026
90%50%10%1%

What each source reports

CVE List Score used2.3

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-184
Updated
2026-11-05
EUVDEUVD-2026-1138322.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
EUVD-2026-113832
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-9f6m-7pvr-98322.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated...

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
GHSA-9f6m-7pvr-9832
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-184
Updated
2026-11-02
NVD2.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-184
Updated
2026-11-05
OSVDEBIAN-CVE-2026-1195672.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
DEBIAN-CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-06
OSVUBUNTU-CVE-2026-1195672.3

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
UBUNTU-CVE-2026-119567
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-05
OSVAZL-111796No score

CVE-2026-119567 affecting package vsftpd 3.0.5-1

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Record
AZL-111796
Updated
2026-11-05
OSVopenSUSE-SU-2026:12522-1No score

vsftpd-3.0.5-21.1 on GA media

These are all security issues fixed in the vsftpd-3.0.5-21.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12522-1
Updated
2026-11-11
OSVSUSE-SU-2026:5222-1No score

Security update for vsftpd

This update for vsftpd fixes the following issues:

  • CVE-2025-14242: denial of service via integer overflow in ls command parameter parsing (bsc#1256700).
  • CVE-2026-119567: access control bypass allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases (bsc#1288995).
  • CVE-2026-119568: authentication bypass in ssl_data_accept() allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket (bsc#1288996).
Record
SUSE-SU-2026:5222-1
Updated
2026-11-13

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vsftpd
Azure Linux:3
through 3.0.5-1None known
vsftpd
Debian:12
All versions, plus listed versions
3.0.3-133.0.3-13.13.0.5-0.13.0.5-0.23.0.5-0.3
Show 5 moreShow less
3.0.5-0.43.0.5-0.53.0.5-0.63.0.5-0.73.0.5-1
None known
vsftpd
Debian:13
All versions, plus listed versions
3.0.5-0.23.0.5-0.33.0.5-0.43.0.5-0.53.0.5-0.63.0.5-0.73.0.5-1
None known
vsftpd
Debian:14
All versions, plus listed versions
3.0.5-0.23.0.5-0.33.0.5-0.43.0.5-0.53.0.5-0.63.0.5-0.73.0.5-1
None known
vsftpd
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
vsftpd
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
before 3.0.5-150400.3.19.1
3.0.5-150400.3.19.1
vsftpd
Ubuntu:14.04:LTS
All versions, plus listed versions
3.0.2-1ubuntu23.0.2-1ubuntu2.14.04.1
None known
vsftpd
Ubuntu:16.04:LTS
All versions, plus listed versions
3.0.2-20ubuntu13.0.3-1ubuntu13.0.3-2ubuntu13.0.3-3ubuntu2
None known
vsftpd
Ubuntu:18.04:LTS
All versions, plus listed versions
3.0.3-93.0.3-9build1
None known
vsftpd
Ubuntu:20.04:LTS
All versions, plus listed versions
3.0.3-123.0.5-0ubuntu0.20.04.13.0.5-0ubuntu0.20.04.2
None known
vsftpd
Ubuntu:22.04:LTS
All versions, plus listed versions
3.0.3-13build13.0.3-13build23.0.5-0ubuntu13.0.5-0ubuntu1.1
None known
vsftpd
Ubuntu:24.04:LTS
All versions, plus listed versions
3.0.5-0ubuntu13.0.5-0ubuntu23.0.5-0ubuntu33.0.5-0ubuntu3.1
None known
vsftpd
Ubuntu:26.10
All versions, plus listed versions
3.0.5-0.43.0.5-0.73.0.5-1build1
None known
vsftpd
Ubuntu:26.04:LTS
All versions, plus listed versions
3.0.5-0.33.0.5-0.4
None known
vsftpd
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 3.0.5-21.1
3.0.5-21.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesCVE List, EUVD, NVD, OSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119567 is a low vulnerability (CVSS 2.3) in Vsftpd, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open