ALPINE-CVE-2026-119147: Medium severity alpine/proftpd vulnerability

Q: What conditions are required to exploit this issue?

An attacker needs authenticated SFTP access, read access to a source file, and the ability to invoke the mod_sftp copy-file extension. The destination must be a new file path in a directory where the user is denied uploads by Limit WRITE rules.

Q: Which deployments are exposed?

Deployments using ProFTPD's mod_sftp copy-file extension are exposed when they rely on Limit WRITE to prevent users from creating files in particular directories. The bypass applies specifically to creation of new destination files.

Q: How can I determine whether my configuration is affected?

Check whether the ProFTPD version is before 1.3.9e or is 1.3.10rc5, and whether authenticated SFTP users can use the copy-file extension. Also review whether Limit WRITE denies file creation in directories containing paths where those users can read source files.

Published Oct 30, 2026

Updated

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Affected Software

2 affected componentsFixes available

alpine/proftpd<1.3.9e-r0

1.3.9e-r0

alpine/proftpd<1.3.9e-r0

1.3.9e-r0

Event History

Oct 30, 2026

CVE Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker needs authenticated SFTP access, read access to a source file, and the ability to invoke the mod_sftp copy-file extension. The destination must be a new file path in a directory where the user is denied uploads by Limit WRITE rules.

Which deployments are exposed?

Deployments using ProFTPD's mod_sftp copy-file extension are exposed when they rely on Limit WRITE to prevent users from creating files in particular directories. The bypass applies specifically to creation of new destination files.

How can I determine whether my configuration is affected?

Check whether the ProFTPD version is before 1.3.9e or is 1.3.10rc5, and whether authenticated SFTP users can use the copy-file extension. Also review whether Limit WRITE denies file creation in directories containing paths where those users can read source files.

ALPINE-CVE-2026-119147: Medium severity alpine/proftpd vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

Which deployments are exposed?

How can I determine whether my configuration is affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

Which deployments are exposed?

How can I determine whether my configuration is affected?