UBUNTU-CVE-2026-119567: Low severity ubuntu/vsftpd vulnerability
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmdsdenied check in processpostlogin() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Servers running vsftpd through 3.0.5 are exposed if they rely on cmds_denied to block FTP commands that have RFC 775 X-prefixed aliases. An attacker must be able to authenticate as an FTP user.
What does an attacker need to do to bypass the restriction?
The attacker needs valid FTP credentials and must issue an X-prefixed alias for a denied command. Examples include XRMD, XMKD, XCWD, XPWD, and XCUP, which can bypass literal-token checks on the corresponding standard commands.
Are default configurations affected?
The available information identifies the bypass specifically in deployments using cmds_denied to restrict commands. It does not state whether cmds_denied is enabled or populated by default.
What is the impact of successful exploitation?
A successful attacker can execute FTP operations that the server administrator attempted to deny, including operations such as deleting directories. The stated impact is integrity-related; no confidentiality or availability impact is specified.