Loading vulnerability…
ProFTPD RNFR path canonicalization access-control bypass
CVE-2026-35025 is an access-control bypass in ProFTPD through 1.3.9b and 1.3.10rc2. Authenticated FTP users can circumvent Directory ACL restrictions by submitting paths prefixed with the procfs process-root symbolic link to the RNFR command handler. Unresolved symbolic-link components in dir_canonical_path() cause dir_check() to perform lexical comparisons that match no configured Directory block. This permits rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Sessions configured with DefaultRoot chroot are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Authenticated FTP users can bypass configured Directory ACL protections to rename protected files and subsequently retrieve their contents. This compromises the confidentiality of protected content and permits unauthorized changes to file names or locations.
If you can’t patch tonight, do this now.
Configure affected FTP sessions with DefaultRoot chroot. Chroot changes the root directory resolved by the procfs process-root symbolic link, preventing the described bypass.
Patch, then assume compromise.
Upgrade to a vendor-fixed ProFTPD release addressing RNFR path canonicalization and Directory ACL enforcement. A specific fixed version is not identified. If a fixed release is unavailable, configure DefaultRoot chroot as an interim workaround.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.