Low severity3.1NVD Advisory· Published Oct 30, 2026

CVE-2026-119567

Description

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Affected products

Vsftpd Project/Vsftpdllm-create
Range: <=3.0.5

Patches

Vulnerability mechanics

References

abraxaslabs.tech/research/vsftpd-cmds-denied-aliasnvd
security.appspot.com/vsftpd.htmlnvd
www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliasesnvd

News mentions

No linked articles in our index yet.

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000