AZL-111796: CVE-2026-119567 affecting package vsftpd 3.0.5-1

Q: Who can exploit this issue?

An attacker must be able to authenticate to the FTP service. The issue affects deployments that rely on vsftpd command-denial controls to restrict FTP operations for authenticated users.

Q: What must an attacker do to bypass denied commands?

The attacker sends RFC 775 X-prefixed command aliases instead of the literal command token checked by the denial list. Examples include XRMD, XMKD, XCWD, XPWD, and XCUP.

Q: What operations could bypass the access-control policy?

Blocked operations associated with the aliased commands may still be performed, including deleting directories. The described bypass also covers directory creation, directory changes, working-directory display, and moving to the parent directory.

Published Oct 30, 2026

Updated

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmdsdenied check in processpostlogin() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Affected Software

1 affected component

azure-linux/vsftpd<=3.0.5-1

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119567

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to authenticate to the FTP service. The issue affects deployments that rely on vsftpd command-denial controls to restrict FTP operations for authenticated users.

What must an attacker do to bypass denied commands?

The attacker sends RFC 775 X-prefixed command aliases instead of the literal command token checked by the denial list. Examples include XRMD, XMKD, XCWD, XPWD, and XCUP.

What operations could bypass the access-control policy?

Blocked operations associated with the aliased commands may still be performed, including deleting directories. The described bypass also covers directory creation, directory changes, working-directory display, and moving to the parent directory.

AZL-111796: CVE-2026-119567 affecting package vsftpd 3.0.5-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to bypass denied commands?

What operations could bypass the access-control policy?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to bypass denied commands?

What operations could bypass the access-control policy?