CVE-2026-119567
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Risk Assessment
An authenticated FTP user can bypass restrictions and perform operations that should be denied, potentially leading to data modification or deletion.
Recommendation
Update vsftpd to a version later than 3.0.5 once a fix is available, or restrict access to the FTP server.
Other vulnerabilities in vsftpd
See all- CVE-2026-119568High
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
- CVE-2025-14242Medium
A flaw in vsftpd allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing. A remote, authenticated attacker can crash the server by sending a crafted STAT command with a specific byte sequence.
Original NVD description (English source)
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS