CVE-2026-119147: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

Q: Which deployments are exposed to this issue?

Deployments using affected ProFTPD versions with mod_sftp enabled are exposed where authenticated SFTP users can use the copy-file extension and there are directories protected by Limit WRITE rules.

Q: What access does an attacker need?

An attacker needs authenticated SFTP access. They must also be able to read a source file and use the copy-file extension to create a new destination file.

Q: What is the practical impact?

A permitted SFTP user can create a copy of any readable file at a new path inside a directory where uploads or other writes are intended to be denied. The issue affects creation of new destination files.

Q: Which versions address the issue?

The issue affects versions before ProFTPD 1.3.9e and 1.3.10rc5. Upgrading to 1.3.9e or 1.3.10rc5, or a later version, addresses the affected versions described.

Published Oct 30, 2026

Updated

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Affected Software

4 affected componentsFixes available

debian/proftpd-dfsg*

debian/proftpd-dfsg<=1.3.8+dfsg-4+deb12u5, <=1.3.8+dfsg-4+deb12u4, <=1.3.8.c+dfsg-4+deb13u3, <=1.3.9d~dfsg-1

1.3.9e~dfsg-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/proftpd-dfsg to a version that resolves this vulnerability.
Fixed in 1.3.9e~dfsg-2

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·12:16 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using affected ProFTPD versions with mod_sftp enabled are exposed where authenticated SFTP users can use the copy-file extension and there are directories protected by Limit WRITE rules.

What access does an attacker need?

An attacker needs authenticated SFTP access. They must also be able to read a source file and use the copy-file extension to create a new destination file.

What is the practical impact?

A permitted SFTP user can create a copy of any readable file at a new path inside a directory where uploads or other writes are intended to be denied. The issue affects creation of new destination files.

Which versions address the issue?

The issue affects versions before ProFTPD 1.3.9e and 1.3.10rc5. Upgrading to 1.3.9e or 1.3.10rc5, or a later version, addresses the affected versions described.

CVE-2026-119147: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the practical impact?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the practical impact?

Which versions address the issue?