Read the docs
TI-2026-82979 Aliases CVE-2026-119147GHSA-24hg-mwfp-6pwj

Authorization bypass in ProFTPD mod_sftp copy-file handling

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

ProFTPD before 1.3.9e and from 1.3.10rc1 before 1.3.10rc5 is affected. The mod_sftp copy-file handler skips Limit WRITE checks for new destination files (CWE-863). An authenticated SFTP user can copy any readable file to a new path in directories where uploads are forbidden.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed ProFTPD (ProFTPD Project): 1.3.9e, 1.3.10rc5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProFTPD ProjectProFTPDbefore 1.3.9e; 1.3.10rc1 to before 1.3.10rc51.3.9e, 1.3.10rc5Patch availableCNA
  • ProFTPD VendorProFTPD Project Affected before 1.3.9e; 1.3.10rc1 to before 1.3.10rc5 Fixed in 1.3.9e, 1.3.10rc5 Patch available CNA

Remediation

Upgrade ProFTPD to 1.3.9e or 1.3.10rc5, which fix the flaw in the affected release lines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA ProFTPD (ProFTPD Project) Fixed in 1.3.9e, 1.3.10rc5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ProFTPD 1.3.10rc5, 1.3.9e

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-82978 Buffer overflow in ProFTPD mod_rewrite utf8trans RewriteMapPriority LOW 28
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119147
  2. 2026-10-30 Alias added: GHSA-24hg-mwfp-6pwj
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-11-05 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 4

  • TI-2006-05599 Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows… CVSS 2.0HIGH 10.0
  • TI-2010-05061 ProFTPD 1.3.3c Backdoor Command Execution CVSS 4.0CRITICAL 9.3
  • TI-2003-00766 ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when… CVSS 2.0HIGH 9.0
  • TI-2009-00521 SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote… CVSS 2.0HIGH 7.5
  • TI-1999-00861 Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root… CVSS 2.0HIGH 10.0
  • TI-1999-00363 Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access… CVSS 2.0HIGH 10.0
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences