ProFTPD RNFR Flaw Lets Authenticated Users Bypass Directory ACLs

A high-severity vulnerability, tracked as CVE-2026-35025, was publicly disclosed in ProFTPD affecting versions through 1.3.9b and 1.3.10rc2. The flaw is a post-authentication access control bypass in the RNFR command handler that lets valid FTP users evade configured <Directory> ACL restrictions by prefixing paths with /proc/self/root. The issue stems from unresolved symlink handling in dir_canonical_path(), causing dir_check() to rely on lexical path comparisons that may fail to match the intended directory policy.

Successful exploitation can allow an authenticated user to rename files inside DenyAll-protected directories using RNFR and RNTO, and then potentially retrieve those files afterward. The vulnerability is remotely exploitable and has been rated high severity, with reported scores of 8.6 (CVSS 4.0) and 8.1 (CVSS 3.1). Advisories note that deployments using DefaultRoot are not affected because the chroot environment changes how /proc/self/root resolves, and affected organizations are advised to upgrade to a non-vulnerable ProFTPD release.