Read the docs
TI-2026-83031 Aliases CVE-2026-119567GHSA-9f6m-7pvr-9832

Access control bypass in vsftpd lets FTP users run denied commands

Priority LOW 11CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

vsftpd through 3.0.5 lets authenticated FTP users run commands that the cmds_denied setting is meant to block (CWE-184). The check in process_post_login() compares only literal command names, so the RFC 775 X-prefixed aliases XRMD, XMKD, XCWD, XPWD and XCUP bypass it and perform blocked operations such as deleting directories. An attacker needs valid FTP credentials and network access to the service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vsftpdvsftpdup to 3.0.5—No fix listedCNA
  • vsftpd Vendorvsftpd Affected up to 3.0.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for vsftpd. Red Hat lists Red Hat Enterprise Linux 6 as affected with no fix planned, and Red Hat Enterprise Linux 7, 8, 9 and 10 as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119567
  2. 2026-10-30 Alias added: GHSA-9f6m-7pvr-9832
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-11-05 CISA SSVC decision points changed

References

Advisory 1

Other 1

  • TI-2026-83032 Authentication bypass in vsftpd lets attackers hijack FTPS data channels CVSS 4.0CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences