Is CVE-2026-35025 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35025 being exploited in the wild.

How severe is CVE-2026-35025?

High severity, with a CVSS score of 8.1, published 24 June 2026.

Which products and versions are affected?

ProFTPD Project ProFTPD through 1.3.9b and 1.3.10rc2.

Is there a fix for CVE-2026-35025?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-35025 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-35025?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35025: ProFTPD access control bypass in RNFR command handler

CVE-2026-35025 · Severity: high · CVSS 8.1 · Published 2026-06-24

ProFTPD is a widely used file transfer service for sharing data across networks. A security flaw allows logged-in users to bypass folder restrictions and access or rename files they should not be able to see. This could lead to the unauthorized modification or theft of sensitive corporate data stored on the FTP server.

Quick answers

Is CVE-2026-35025 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35025 being exploited in the wild.
How severe is CVE-2026-35025?: High severity, with a CVSS score of 8.1, published 24 June 2026.
Which products and versions are affected?: ProFTPD Project ProFTPD through 1.3.9b and 1.3.10rc2.
Is there a fix for CVE-2026-35025?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-35025 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-35025?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An access control bypass exists in ProFTPD's RNFR (Rename From) command handler due to improper link resolution. By prefixing file paths with '/proc/self/root', an authenticated attacker can exploit unresolved symlink components in the 'dir_canonical_path()' function. This causes 'dir_check()' to perform lexical path comparisons that fail to match configured <Directory> blocks, effectively bypassing 'DenyAll' protections. Successful exploitation allows an attacker to rename and subsequently retrieve files from restricted directories. The vulnerability does not affect sessions configured with 'DefaultRoot' (chroot), as the chroot environment changes how '/proc/self/root' is resolved.

Affected products

ProFTPD Project ProFTPD through 1.3.9b and 1.3.10rc2

Timeline

2026-06-24: disclosed: Public issue opened on GitHub and NVD entry published.
2026-06-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.