Vulnerability Description
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Proftpd | Proftpd | <= 1.3.9b |
Related Weaknesses (CWE)
References
- http://www.proftpd.org/ProductRelease Notes
- https://github.com/proftpd/proftpd/issues/2170Issue TrackingMitigation
- https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-Third Party Advisory
FAQ
What is CVE-2026-35025?
CVE-2026-35025 is a vulnerability with a CVSS score of 8.1 (HIGH). ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/roo...
How severe is CVE-2026-35025?
CVE-2026-35025 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35025?
Check the references section above for vendor advisories and patch information. Affected products include: Proftpd Proftpd.