CVE-2026-35025 Details
Description
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
An access control bypass vulnerability has been identified in ProFTPD versions through 1.3.9b and 1.3.10rc2. This vulnerability allows authenticated FTP users to circumvent Directory ACL restrictions. By prefixing paths with '/proc/self/root' in the RNFR command handler, attackers can exploit unresolved symlink components to manipulate directory checks. This manipulation enables rename operations on files in directories protected by 'DenyAll' ACLs, allowing subsequent retrieval of those files. Sessions using 'DefaultRoot' (chroot) are not affected, as chroot alters the resolution of '/proc/self/root'.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/proftpd/proftpd/issues/2170 | [email protected] | Issue TrackingMitigation |
| https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr | [email protected] | Third Party Advisory |
| http://www.proftpd.org/ | [email protected] | ProductRelease Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| proftpd proftpd | <= 1.3.9b 1.3.10 rc1 1.3.10 rc2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |