DEBIAN-CVE-2026-119364: Medium severity debian/proftpd-dfsg vulnerability
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in modcopy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/proftpd-dfsgto a version that resolves this vulnerability.Fixed in 1.3.9e~dfsg-3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid FTP authentication and access to a directory where they can create a symlink. The issue affects deployments that use mod_copy and rely on Limit WRITE restrictions to prevent writes to other locations.
What conditions are required for exploitation?
The attacker must be able to place a symlink in a writable directory, then invoke the SITE COPY or SITE CPTO FTP commands. Exploitation also depends on a target file location that is denied by the server's Limit WRITE configuration.
What is the impact of a successful exploit?
A successful attacker can bypass Limit WRITE restrictions and overwrite files in locations that should be write-denied. The provided severity data indicates integrity impact but no stated confidentiality or availability impact.
How can I determine whether a server may be affected?
Check whether the server runs ProFTPD through 1.3.9e or 1.3.10rc1 through 1.3.10rc4, has mod_copy enabled, permits authenticated users to write in any FTP-accessible directory, and uses Limit WRITE restrictions. Review FTP activity for SITE COPY or SITE CPTO operations involving symlinks in writable directories.