| Name | CVE-2026-35025 |
| Description | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| proftpd-dfsg (PTS) | bullseye | 1.3.7a+dfsg-12+deb11u2 | vulnerable |
| bullseye (security) | 1.3.7a+dfsg-12+deb11u5 | vulnerable |
| bookworm | 1.3.8+dfsg-4+deb12u5 | vulnerable |
| bookworm (security) | 1.3.8+dfsg-4+deb12u4 | vulnerable |
| trixie | 1.3.8.c+dfsg-4+deb13u2 | vulnerable |
| forky, sid | 1.3.9c~dfsg-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| proftpd-dfsg | source | (unstable) | (unfixed) | unimportant | | |
Notes
[trixie] - proftpd-dfsg <postponed> (Minor issue, revisit when fixed upstream)
https://github.com/proftpd/proftpd/issues/2170
Negligible impact, upstream does not want to make a special/edge case for /proc
access in core ProFTPD code. Instead a new mod_procfs module is introduced,
wich rejects commands which refer to paths in /proc, cf.
https://github.com/proftpd/proftpd/issues/2170#issuecomment-4998331303