Live › vulnerability › CVE-2026-119147
ProFTPD's mod_sftp copy-file extension skips Limit WRITE checks when creating new destination files. An authenticated SFTP user can copy any readable file to a new path in a directory where uploads are forbidden.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Servers running ProFTPD before 1.3.9e or 1.3.10rc5 with mod_sftp enabled and SFTP logins for users. The risk is highest where Limit WRITE rules are used to protect directories from uploads. Systems without mod_sftp or without authenticated SFTP users are unlikely to be exposed.
No product ranges from the sources yet.
proftpd -vmod_sftp in the loaded modules and for Limit WRITE rules in proftpd.conf1.3.9e and 1.3.10rc5 are affected; move to 1.3.9e or or later1.3.10rc5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
This page as .md · .json · in your agent: get_signal("CVE-2026-119147")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.