Vulnerability record/PUBLISHED/Published Oct 30, 2026 11:31:13 UTC

CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Base score2.3/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorNetworkAV

Attack complexityHighAC

Attack requirementsPresentAT

Privileges requiredLowPR

User interactionNoneUI

Vulnerable system confidentialityNoneVC

Vulnerable system integrityLowVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedOct 30, 2026 11:31:13 UTC

PublishedOct 30, 2026 11:31:13 UTC

ReservedOct 30, 2026 10:53:32 UTC

Credits

Abraxas Labs