{"id":"CVE-2026-35025","aliases":["DEBIAN-CVE-2026-35025","EUVD-2026-38789","GHSA-9vr4-2f43-pc8v","SUSE-SU-2026:5181-1","UBUNTU-CVE-2026-35025","openSUSE-SU-2026:12517-1"],"status":"published","title":"ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00505,"percentile":0.43635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-59"],"published":"2026-06-24T13:21:42Z","modified":"2026-11-11T17:27:05Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg-4","1.3.8+dfsg-4+deb12u1","1.3.8+dfsg-4+deb12u2","1.3.8+dfsg-4+deb12u3","1.3.8+dfsg-4+deb12u4","1.3.8+dfsg-4+deb12u5","1.3.8+dfsg-5","1.3.8+dfsg-6","1.3.8+dfsg-7","1.3.8+dfsg-8","1.3.8.a+dfsg-1","1.3.8.b+dfsg-1","1.3.8.b+dfsg-2","1.3.8.b+dfsg-3","1.3.8.b+dfsg-4","1.3.8.c+dfsg-1","1.3.8.c+dfsg-2","1.3.8.c+dfsg-3","1.3.8.c+dfsg-4","1.3.9a~dfsg-1","1.3.9b~dfsg-1","1.3.9c~dfsg-1","1.3.9d~dfsg-1","1.3.9~dfsg-1","1.3.9~dfsg-2","1.3.9~dfsg-3","1.3.9~dfsg-4","1.3.9~dfsg-5"]},{"source":"osv","ecosystem":"Debian:13","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8.c+dfsg-4","1.3.8.c+dfsg-4+deb13u1","1.3.8.c+dfsg-4+deb13u2","1.3.8.c+dfsg-4+deb13u3","1.3.9a~dfsg-1","1.3.9b~dfsg-1","1.3.9c~dfsg-1","1.3.9d~dfsg-1","1.3.9~dfsg-1","1.3.9~dfsg-2","1.3.9~dfsg-3","1.3.9~dfsg-4","1.3.9~dfsg-5"]},{"source":"osv","ecosystem":"Debian:14","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8.c+dfsg-4","1.3.9a~dfsg-1","1.3.9b~dfsg-1","1.3.9c~dfsg-1","1.3.9d~dfsg-1","1.3.9~dfsg-1","1.3.9~dfsg-2","1.3.9~dfsg-3","1.3.9~dfsg-4","1.3.9~dfsg-5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-2","1.3.5a-1","1.3.5a-1build1","1.3.5a-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5d-1","1.3.5e-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.6-6build2","1.3.6c-1","1.3.6c-2","1.3.6c-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.7b+dfsg-1","1.3.7c+dfsg-1build1","1.3.7c+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg-8","1.3.8.a+dfsg-1","1.3.8.b+dfsg-1","1.3.8.b+dfsg-1build1","1.3.8.b+dfsg-1build2","1.3.8.b+dfsg-1build3","1.3.8.b+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8.c+dfsg-2","1.3.8.c+dfsg-4","1.3.9~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9~dfsg-4","1.3.9b~dfsg-1","1.3.9d~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9~dfsg-3","1.3.9~dfsg-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9e-2.1"}]}],"bundled":5}],"products":[{"vendor":"proftpd","product":"proftpd"},{"vendor":"proftpd project","product":"proftpd"}],"references":[{"url":"https://github.com/proftpd/proftpd/issues/2170","tags":["technical-description","issue-tracking","Issue Tracking","Mitigation","report"]},{"url":"http://www.proftpd.org/","tags":["product","Product","Release Notes","web"]},{"url":"https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35025","tags":["advisory"]},{"url":"http://www.proftpd.org"},{"url":"https://github.com/advisories/GHSA-9vr4-2f43-pc8v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35025.json","tags":["advisory"]},{"url":"https://github.com/proftpd/proftpd","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-35025","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265181-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263183","tags":["report"]},{"url":"https://bugzilla.suse.com/1264262","tags":["report"]},{"url":"https://bugzilla.suse.com/1269065","tags":["report"]},{"url":"https://bugzilla.suse.com/1271096","tags":["report"]},{"url":"https://bugzilla.suse.com/1271097","tags":["report"]},{"url":"https://bugzilla.suse.com/1271944","tags":["report"]},{"url":"https://bugzilla.suse.com/1271945","tags":["report"]},{"url":"https://bugzilla.suse.com/1271946","tags":["report"]},{"url":"https://bugzilla.suse.com/1289272","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63091","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-35025","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35025","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-35025","title":"ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T13:21:42.281Z","modified":"2026-11-08T14:02:27.201Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-38789","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T13:21:42Z","modified":"2026-11-08T14:02:27Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:09.268962Z"}],"ghsa":[{"id":"GHSA-9vr4-2f43-pc8v","title":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows...","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T15:31:47Z","modified":"2026-06-24T15:31:50Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:08:58.190411Z"}],"nvd":[{"id":"CVE-2026-35025","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T14:17:30.95Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"CVE-2026-35025","title":"ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T13:21:42.281Z","modified":"2026-11-11T17:27:05.883348805Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-09T03:16:24.800471Z"},{"id":"DEBIAN-CVE-2026-35025","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T14:17:30.95Z","modified":"2026-10-26T11:47:26.815404883Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-35025","description":"ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.","status":"published","published":"2026-06-24T14:17:00Z","modified":"2026-10-17T13:00:02.871683773Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"openSUSE-SU-2026:12517-1","title":"proftpd-1.3.9e-2.1 on GA media","description":"These are all security issues fixed in the proftpd-1.3.9e-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-10T00:00:00Z","modified":"2026-11-11T17:23:11.707849734Z","updated_at":"2026-11-11T17:47:15.466074Z"},{"id":"SUSE-SU-2026:5181-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\n- Authenticated SFTP sessions can overflow the SFTP packet buffer (bsc#1271096).\n- CVE-2026-35025: access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions by\n  prefixing paths with `/proc/self/root` in the RNFR command handler (bsc#1269065).\n- CVE-2026-42167: `mod_sql` allows remote attackers to execute arbitrary code via a username when there is logging of\n  `USER` requests with an expansion such as `%U` and the SQL backend allows `comman` (bsc#1263183).\n- CVE-2026-44331: SQL injection in `sqltab_fetch_clients_cb()` in `contrib/mod_wrap2_sql.c` triggered via crafted domain\n  name from reverse DNS lookup (bsc#1264262).\n- CVE-2026-53994: heap-based buffer overflow reachable by an authenticated SFTP user can lead to denial of service and\n  memory corruption (bsc#1271946).\n- CVE-2026-63090: heap-based buffer overflow in the `mod_sftp` module can lead to arbitrary code execution via crafted\n  SFTP packet fragments (bsc#1271944).\n- CVE-2026-63091: signed integer overflow in the `mod_sftp` module's SCP size-record parser can lead to ASLR bypass via\n  a crafted file size value of `UINT64_MAX` (bsc#1271945).\n- CVE-2026-119147: authorization bypass in the `mod_sftp` copy-file extension handler allows SFTP users to copy any\n  readable file to a new path in write-denied directories (bsc#1289272).\n- Integer overflow via client-provided file size for SCP uploads (bsc#1271097).\n","status":"published","published":"2026-11-10T17:39:43Z","modified":"2026-11-11T13:00:04.395234588Z","updated_at":"2026-11-11T13:08:46.301371Z"}]}}