UBUNTU-CVE-2026-119364: Medium severity ubuntu/proftpd-dfsg vulnerability
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in modcopy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated FTP user is required. The user must be able to create a symlink in a writable directory and invoke the SITE COPY or SITE CPTO command.
Which configurations are exposed?
Servers using mod_copy are exposed where Limit WRITE restrictions deny writes to some locations while the attacker can create symlinks in another writable directory. The issue enables those write restrictions to be bypassed through symlink traversal.
What could an attacker do?
An attacker can overwrite files in locations where direct writes are denied by Limit WRITE rules. The supplied data identifies integrity impact only; it does not describe confidentiality or availability impact.
How can administrators identify potential exposure?
Check whether the deployed ProFTPD version is through 1.3.9e or is 1.3.10rc1 through 1.3.10rc4, and whether mod_copy is enabled. Also review whether FTP users can create symlinks in writable directories while SITE COPY or SITE CPTO can reach write-denied paths.