CVE-2026-119147
ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
| CWE | CWE-863 |
| Vendor | proftpd project |
| Product | proftpd |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for proftpd project proftpd
Be the first to know when new medium vulnerabilities affecting proftpd project proftpd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
ProFTPD Project / ProFTPD
0 < 1.3.9e 1.3.10rc1 < 1.3.10rc5
References
github.com: https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16 github.com: https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748 github.com: https://github.com/proftpd/proftpd/releases/tag/v1.3.9e github.com: https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5 abraxaslabs.tech: https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write github.com: https://github.com/proftpd/proftpd vulncheck.com: https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass
Credits
Abraxas Labs MiniMax Security TJ Saunders