Medium severity4.3NVD Advisory· Published Oct 30, 2026
CVE-2026-119147
CVE-2026-119147
Description
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6- abraxaslabs.tech/research/proftpd-sftp-copy-file-writenvd
- github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.cnvd
- github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16nvd
- github.com/proftpd/proftpd/releases/tag/v1.3.10rc5nvd
- github.com/proftpd/proftpd/releases/tag/v1.3.9envd
- www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypassnvd
News mentions
0No linked articles in our index yet.