CVE-2026-35025

NameCVE-2026-35025
DescriptionProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
proftpd-dfsg (PTS)bullseye1.3.7a+dfsg-12+deb11u2vulnerable
bullseye (security)1.3.7a+dfsg-12+deb11u5vulnerable
bookworm1.3.8+dfsg-4+deb12u5vulnerable
bookworm (security)1.3.8+dfsg-4+deb12u4vulnerable
trixie1.3.8.c+dfsg-4+deb13u2vulnerable
forky, sid1.3.9b~dfsg-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
proftpd-dfsgsource(unstable)(unfixed)

Notes

https://github.com/proftpd/proftpd/issues/2170

Search for package or bug name: Reporting problems