CVE-2026-119567: vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmdsdenied check in processpostlogin() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Event History
Frequently Asked Questions
Who is exposed to this bypass?
FTP servers running affected vsftpd versions are exposed only where cmds_denied is used to block one or more of the affected directory-related commands. An attacker must be able to authenticate as an FTP user.
What does an attacker need to do to bypass the restriction?
The attacker sends an RFC 775 X-prefixed alias instead of the literal command token checked by cmds_denied. Examples include XRMD, XMKD, XCWD, XPWD, and XCUP.
Are installations unaffected if they do not use cmds_denied?
The described bypass targets the cmds_denied check in process_post_login(). If cmds_denied is not being relied on to deny these commands, the specific access-control bypass described does not apply.
What is the immediate mitigation if patching is not available?
Do not rely on cmds_denied alone to restrict the affected commands for authenticated users. Restrict FTP account permissions so users cannot perform the underlying directory operations they should not be allowed to perform.