Low 3.1

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated...

CVE-2026-119567 First seen on SecPulse Oct 30, 20:31

Affected packages

Ecosystem	Package	Affected	Fixed
vsftpd	vsftpd	≤ 3.0.5	—

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-119567 vsftpd

Original description The description as published by the source.

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Low 3.1; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4: Low 2.3; CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Oct 30, 2026
First seen on SecPulse: Oct 30, 20:31
GHSA: GHSA-9f6m-7pvr-9832
CWE: CWE-184

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-184

All

Vsftpd

Operating Systems

RHEL

Detection sources

NIST National Vulnerability DatabaseOct 31, 04:21
GitHub Security Advisories (Global)Oct 30, 21:31
Red Hat Security AdvisoriesOct 31, 09:30
CVE.org (CVE Program・cvelistV5)Oct 30, 20:31