CVE-2026-119568
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
Risk Assessment
An attacker may intercept or replace data in a victim's FTPS sessions, leading to leakage of confidential files or injection of malicious data. The risk affects environments where multiple clients share an IP address (e.g., NAT).
Recommendation
Update vsftpd to a version newer than 3.0.5. Until then, restrict access to PASV ports and consider using unique IP addresses or additional TLS session verification.
Other vulnerabilities in vsftpd
See all- CVE-2026-119567Low
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
- CVE-2025-14242Medium
A flaw in vsftpd allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing. A remote, authenticated attacker can crash the server by sending a crafted STAT command with a specific byte sequence.
Original NVD description (English source)
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS