Who is not affected by CVE-2026-119364?

Not affected if: mod_copy-disabled, no-ftp-accounts.

Live › vulnerability › CVE-2026-119364

medium6.0Runtime

ProFTPD: symlink tricks let authenticated FTP users overwrite write-protected files

ProFTPD's mod_copy module follows symbolic links, so a logged-in FTP user can bypass Limit WRITE rules. An attacker can overwrite files in locations that should be write-denied.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

6.0

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 30, 2026 UTC
Last modified: Oct 30, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.

Who is affected

Servers running ProFTPD versions through 1.3.9e or 1.3.10rc1 through 1.3.10rc4 with mod_copy loaded are exposed. The attacker must hold a valid FTP login and be able to write to a directory where they can create symlinks. Servers without mod_copy or without authenticated FTP users can skip it.

No product ranges from the sources yet.

Who cares: ftp, proftpd, self-hosted
Not affected if: mod_copy-disabled, no-ftp-accounts

How to check

Run proftpd -v to get the installed version and compare it with the affected ranges.
Check whether mod_copy is loaded and whether SITE COPY or SITE CPTO is enabled in the proftpd configuration.
Review Limit WRITE rules in the proftpd configuration for write-denied directories.

The fix

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 are affected; the sources do not name a fixed version.

Who had it, and when

1 source

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-119364

medium6.0Runtime

ProFTPD: symlink tricks let authenticated FTP users overwrite write-protected files

ProFTPD's mod_copy module follows symbolic links, so a logged-in FTP user can bypass Limit WRITE rules. An attacker can overwrite files in locations that should be write-denied.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

6.0

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 30, 2026 UTC
Last modified: Oct 30, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.

Who is affected

No product ranges from the sources yet.

Who cares: ftp, proftpd, self-hosted
Not affected if: mod_copy-disabled, no-ftp-accounts

How to check

Run proftpd -v to get the installed version and compare it with the affected ranges.
Check whether mod_copy is loaded and whether SITE COPY or SITE CPTO is enabled in the proftpd configuration.
Review Limit WRITE rules in the proftpd configuration for write-denied directories.

The fix

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 are affected; the sources do not name a fixed version.

Who had it, and when

1 source

Know the next one before it finds you.

Add to Slack

ProFTPD: symlink tricks let authenticated FTP users overwrite write-protected files

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

ProFTPD: symlink tricks let authenticated FTP users overwrite write-protected files

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

What the sources say, verbatim

Sources