CVE details
CVE-2026-35025
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.
Affected ports (6)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| databases/proftpd-mod_sql_mysql | proftpd-mod_sql_mysql | 1.3.8c_2 | unaddressed | mm@FreeBSD.org |
| databases/proftpd-mod_sql_odbc | proftpd-mod_sql_odbc | 1.3.8c_2 | unaddressed | mm@FreeBSD.org |
| databases/proftpd-mod_sql_postgres | proftpd-mod_sql_postgres | 1.3.8c_4 | unaddressed | mm@FreeBSD.org |
| databases/proftpd-mod_sql_sqlite | proftpd-mod_sql_sqlite | 1.3.8c_5 | unaddressed | mm@FreeBSD.org |
| ftp/proftpd | proftpd | 1.3.8c_3 | unaddressed | mm@FreeBSD.org |
| net/proftpd-mod_ldap | proftpd-mod_ldap | 1.3.8c_6 | unaddressed | mm@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>proftpd-mod_sql_mysql</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>proftpd-mod_sql_odbc</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>proftpd-mod_sql_postgres</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>proftpd-mod_sql_sqlite</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>proftpd</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>proftpd-mod_ldap</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass
vulnerability that allows authenticated FTP users to circumvent
Directory ACL restrictions by prefixing paths with /proc/self/root in
the RNFR command handler. Attackers can exploit the unresolved symlink
components in dir_canonical_path() to cause dir_check() to perform
lexical path comparisons that match no configured Directory block,
enabling rename operations on files in DenyAll-protected directories
and subsequent retrieval of those files. Mitigation: Sessions
configured with DefaultRoot (chroot) are not affected, as chroot
changes the directory to which /proc/self/root resolves.</p>
</body>
</description>
<references>
<cvename>CVE-2026-35025</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-35025</url>
</references>
<dates>
<discovery>2026-06-24</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>