[{"vendor":"ProFTPD Project","product":"ProFTPD","defaultStatus":"affected","repo":"https://github.com/proftpd/proftpd","versions":[{"version":"0","lessThanOrEqual":"1.3.9b","versionType":"custom","status":"affected"},{"version":"0","lessThanOrEqual":"1.3.10rc2","versionType":"custom","status":"affected"}]}]

[{"vendor":"ProFTPD Project","product":"ProFTPD","defaultStatus":"affected","repo":"https://github.com/proftpd/proftpd","packageURL":"pkg:github/proftpd/proftpd","versions":[{"version":"0","lessThanOrEqual":"1.3.9b","versionType":"custom","status":"affected"},{"version":"0","lessThanOrEqual":"1.3.10rc2","versionType":"custom","status":"affected"}]}]

OR
          *cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* versions up to (including) 1.3.9b
          *cpe:2.3:a:proftpd:proftpd:1.3.10:rc1:*:*:*:*:*:*
          *cpe:2.3:a:proftpd:proftpd:1.3.10:rc2:*:*:*:*:*:*

VulnCheck: http://www.proftpd.org/ Types: Product, Release Notes

VulnCheck: https://github.com/proftpd/proftpd/issues/2170 Types: Issue Tracking, Mitigation

VulnCheck: https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr Types: Third Party Advisory

{"timestamp":"2026-06-24T15:00:28.448881Z","id":"CVE-2026-35025","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-59

http://www.proftpd.org/

https://github.com/proftpd/proftpd/issues/2170

https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr

[{"vendor":"ProFTPD Project","product":"ProFTPD","defaultStatus":"affected","repo":"https://github.com/proftpd/proftpd","versions":[{"version":"0","lessThanOrEqual":"1.3.9b","versionType":"custom","status":"affected"},{"version":"0","lessThanOrEqual":"1.3.10rc2","versionType":"custom","status":"affected"}]}]