# CVE-2026-119147: ProFTPD authorization bypass in mod_sftp copy-file handler

Source: https://junglewise.ai/threats/cve-2026-119147-proftpd-before-1-3-9e-and-1-3-10rc5-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119147 · Severity: medium · CVSS 4.3 · Published 2026-10-30

ProFTPD is an FTP/SFTP server that manages file transfer access on servers. An authorization flaw in the SFTP copy-file extension allows authenticated users to bypass write restrictions and create files in directories where uploads are normally forbidden. An attacker with SFTP access can copy readable files to restricted locations, potentially circumventing file upload policies.

Vendors: [ProFTPD Project](https://junglewise.ai/threats/vendors/proftpd-project).

## Quick answers

**Is CVE-2026-119147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119147 being exploited in the wild.

**How severe is CVE-2026-119147?** Medium severity, with a CVSS score of 4.3, published 30 October 2026.

**Which products and versions are affected?** ProFTPD Project ProFTPD before 1.3.9e and before 1.3.10rc5.

**Is there a fix for CVE-2026-119147?** Yes: fixed in ProFTPD 1.3.9e, 1.3.10rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119147 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-119147?** Check whether you run ProFTPD Project ProFTPD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ProFTPD 1.3.9e, 1.3.10rc5 or later

## Technical details

The mod_sftp copy-file extension handler fails to check Limit WRITE directives when creating destination files, allowing authenticated SFTP users to bypass authorization controls. The vulnerability affects the copy operation for new destination files, enabling an attacker to place files in write-denied directories. A fix is available in versions 1.3.9e and 1.3.10rc5 or later.

## Affected products

- ProFTPD Project ProFTPD before 1.3.9e and before 1.3.10rc5

## Timeline

- 2026-10-30: disclosed

## References

- [https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write](https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write)
- [https://github.com/proftpd/proftpd](https://github.com/proftpd/proftpd)