CVE tracker

CVE-2026-119567

CVE-2026-119567Low 2.3Published 30 Oct 2026, 13:16

Research and translation in progress – available shortly.

Original description (NVD)

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

NVD references (3)

https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias
https://security.appspot.com/vsftpd.html
https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.