Executive brief
ProFTPD is a widely used file transfer service for sharing data across networks. A security flaw allows logged-in users to bypass folder restrictions and access or rename files they should not be able to see. This could lead to the unauthorized modification or theft of sensitive corporate data stored on the FTP server.
Technical details
An access control bypass exists in ProFTPD's RNFR (Rename From) command handler due to improper link resolution. By prefixing file paths with '/proc/self/root', an authenticated attacker can exploit unresolved symlink components in the 'dir_canonical_path()' function. This causes 'dir_check()' to perform lexical path comparisons that fail to match configured <Directory> blocks, effectively bypassing 'DenyAll' protections. Successful exploitation allows an attacker to rename and subsequently retrieve files from restricted directories. The vulnerability does not affect sessions configured with 'DefaultRoot' (chroot), as the chroot environment changes how '/proc/self/root' is resolved.
Affected products
- ProFTPD Project ProFTPD through 1.3.9b and 1.3.10rc2
Timeline
- 2026-06-24: disclosed: Public issue opened on GitHub and NVD entry published.
- 2026-06-24: advisory