UBUNTU-CVE-2026-119147: Medium severity ubuntu/proftpd-dfsg vulnerability
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be an authenticated SFTP user. They also need read access to the source file they want to copy.
Does this vulnerability allow an attacker to read files they could not already read?
No. The issue requires the source file to already be readable by the authenticated user, and the listed impact has no confidentiality loss. It enables creation of a copied file at a new destination where upload writes are denied.
How can I identify potentially affected deployments?
Check whether the deployed ProFTPD version is earlier than 1.3.9e or is 1.3.10rc5, and whether authenticated users can use the mod_sftp copy-file extension. The relevant exposure is in directories protected by Limit WRITE rules that are intended to prohibit uploads.