DEBIAN-CVE-2026-119147: Medium severity debian/proftpd-dfsg vulnerability
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/proftpd-dfsgto a version that resolves this vulnerability.Fixed in 1.3.9e~dfsg-1
Event History
Frequently Asked Questions
What access and permissions does an attacker need?
An attacker needs an authenticated SFTP account and read access to the file they want to copy. They can then use the mod_sftp copy-file extension to create a new destination file even where Limit WRITE would normally deny uploads.
Which installations should be checked first?
Check Debian systems using the proftpd-dfsg package with SFTP enabled, particularly where mod_sftp copy-file functionality is available and Limit WRITE rules protect directories. The issue affects ProFTPD versions before 1.3.9e and version 1.3.10rc5.
How can I determine whether a server is affected?
Determine the installed ProFTPD version and whether the server exposes SFTP through mod_sftp. Servers running a version before 1.3.9e, or 1.3.10rc5, should be treated as affected when authenticated users can use the copy-file extension.