Access Control Bypass Vulnerability in vsftpd FTP Server
CVE-2026-119567

2.3LOW

Key Information:

Vendor

Vsftpd

Status
Vsftpd
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119567?

The vsftpd FTP server experiences an access control bypass vulnerability, allowing authenticated users to execute prohibited commands via RFC 775 X-prefixed aliases. Specifically, the cmds_denied check in the process_post_login() function inadequately compares tokens literally, enabling unauthorized execution of commands such as XRMD, XMKD, XCWD, XPWD, and XCUP. This flaw can result in critical operations, like the deletion of directories, being executed despite explicit access restrictions.

Affected Version(s)

vsftpd 0 <= 3.0.5

References

https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias
third-party-advisory
https://security.appspot.com/vsftpd.html
product
https://www.vulncheck.com/advisories/vsftpd-through-3.0.5...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.