Live › vulnerability › CVE-2026-119567
vsftpd through 3.0.5 checks denied FTP commands by literal name, so an authenticated user can send legacy X-prefixed aliases such as XRMD or XMKD to run them anyway. The attacker gets the blocked operations the server was configured to refuse, such as deleting directories.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Only servers running vsftpd through 3.0.5 that rely on the cmds_denied setting to block FTP commands for logged-in users. Anonymous-only servers and setups that do not use cmds_denied are not exposed through this flaw. The sources do not name a fixed release.
No product ranges from the sources yet.
vsftpd -v or check the installed package version; the sources list 3.0.5 and earlier as affected.cmds_denied in the vsftpd configuration file (commonly /etc/vsftpd.conf); the bypass only matters if this restriction is in use.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
This page as .md · .json · in your agent: get_signal("CVE-2026-119567")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.