Loading story…
A high-severity vulnerability, tracked as CVE-2026-35025, was publicly disclosed in ProFTPD affecting versions through 1.3.9b and 1.3.10rc2. The flaw is a post-authentication access control bypass in the RNFR command handler that lets valid FTP users evade configured <Directory> ACL restrictions by prefixing paths with /proc/self/root. The issue stems from unresolved symlink handling in dir_canonical_path(), causing dir_check() to rely on lexical path comparisons that may fail to match the intended directory policy.
Successful exploitation can allow an authenticated user to rename files inside DenyAll-protected directories using RNFR and RNTO, and then potentially retrieve those files afterward. The vulnerability is remotely exploitable and has been rated high severity, with reported scores of 8.6 (CVSS 4.0) and 8.1 (CVSS 3.1). Advisories note that deployments using DefaultRoot are not affected because the chroot environment changes how /proc/self/root resolves, and affected organizations are advised to upgrade to a non-vulnerable ProFTPD release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A public disclosure described CVE-2026-35025, a post-authentication access control bypass in ProFTPD affecting versions through 1.3.9b and 1.3.10rc2. The flaw lets authenticated FTP users evade Directory ACL restrictions via /proc/self/root in the RNFR handler; deployments using DefaultRoot are noted as not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcevulncheck.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026
A critical SQL injection flaw in ProFTPD's `mod_sql` module, tracked as **CVE-2026-42167**, can let remote attackers manipulate database-backed FTP authentication and, in some deployments, achieve remote code execution. The bug affects ProFTPD versions before **`1.3.10rc1`** and stems from a logic error in `is_escaped_text()` that can misclassify attacker-controlled quoted input as already escaped when `USER` requests are logged through `SQLNamedQuery` expansions such as `%U`. Advisories and reporting say the weakness can be abused for authentication bypass, privilege escalation, data theft, and arbitrary code execution, with the issue classified as **CWE-89** and assigned a **CVSS 8.1** severity rating.
Jun 29, 2026
A command injection vulnerability in the Node.js FTP client library **basic-ftp** allows attacker-controlled file path input containing `CRLF` sequences to inject unintended FTP commands over the control connection. Tracked as **CVE-2026-39983** and **GHSA-CHQC-8P9Q-PQ6Q**, the flaw stems from a design issue in the library's path handling: `protectWhitespace()` only accounts for leading spaces and does not block control characters, while `FtpContext.send()` appends `\r\n` and writes the resulting string directly to the FTP control socket. The bug affects multiple high-level client methods that accept user-supplied paths, including `cd()`, `remove()`, `list()`, `downloadTo()`, `uploadFrom()`, `rename()`, and `removeDir()`. By embedding `CRLF` characters in a crafted path, an attacker can split one intended FTP request into multiple protocol commands or frames. The issue affects **basic-ftp** versions prior to **5.2.1**, and the vendor has addressed it in version **5.2.1**.
Jun 29, 2026