CVE-2026-119147

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119147", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-29T14:28:41.595Z", "datePublished": "2026-10-30T11:30:36.342Z", "dateUpdated": "2026-11-05T21:07:16.415Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:36.342Z"}, "datePublic": "2026-10-21T00:00:00.000Z", "title": "ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass", "descriptions": [{"lang": "en", "value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "ProFTPD Project", "product": "ProFTPD", "packageURL": "pkg:github/proftpd/proftpd", "repo": "https://github.com/proftpd/proftpd", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "1.3.9e"}, {"version": "1.3.10rc1", "status": "affected", "versionType": "custom", "lessThan": "1.3.10rc5"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.3.9e"}, {"vulnerable": true, "criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.3.10rc1", "versionEndExcluding": "1.3.10rc5"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16", "tags": ["patch"]}, {"url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748", "tags": ["technical-description"]}, {"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e", "tags": ["release-notes"], "name": "ProFTPD v1.3.9e Release Notes"}, {"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5", "tags": ["release-notes"], "name": "ProFTPD v1.3.10rc5 Release Notes"}, {"url": "https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write", "tags": ["third-party-advisory"]}, {"url": "https://github.com/proftpd/proftpd", "tags": ["product"]}, {"name": "VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass"}], "credits": [{"lang": "en", "value": "Abraxas Labs", "type": "finder"}, {"lang": "en", "value": "MiniMax Security", "type": "finder"}, {"lang": "en", "value": "TJ Saunders", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:06:55.706673Z", "id": "CVE-2026-119147", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:07:16.415Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:06:55.706673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:07:09.089Z"}}], "cna": {"title": "ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Abraxas Labs"}, {"lang": "en", "type": "finder", "value": "MiniMax Security"}, {"lang": "en", "type": "remediation developer", "value": "TJ Saunders"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/proftpd/proftpd", "vendor": "ProFTPD Project", "product": "ProFTPD", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.9e", "versionType": "custom"}, {"status": "affected", "version": "1.3.10rc1", "lessThan": "1.3.10rc5", "versionType": "custom"}], "packageURL": "pkg:github/proftpd/proftpd", "defaultStatus": "unaffected"}], "datePublic": "2026-10-21T00:00:00.000Z", "references": [{"url": "https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16", "tags": ["patch"]}, {"url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748", "tags": ["technical-description"]}, {"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e", "name": "ProFTPD v1.3.9e Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5", "name": "ProFTPD v1.3.10rc5 Release Notes", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write", "tags": ["third-party-advisory"]}, {"url": "https://github.com/proftpd/proftpd", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass", "name": "VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.3.9e"}, {"criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.3.10rc5", "versionStartIncluding": "1.3.10rc1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:36.342Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119147", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:07:16.415Z", "dateReserved": "2026-10-29T14:28:41.595Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T11:30:36.342Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/proftpd/proftpd", "product": "ProFTPD", "repo": "https://github.com/proftpd/proftpd", "vendor": "ProFTPD Project", "versions": [{"lessThan": "1.3.9e", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "1.3.10rc5", "status": "affected", "version": "1.3.10rc1", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden."}], "id": "CVE-2026-119147", "lastModified": "2026-11-05T21:18:40.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119147", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:06:55.706673Z", "version": "2.0.3"}}]}, "published": "2026-10-30T12:16:35.373", "references": [{"source": "disclosure@vulncheck.com", "url": "https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/proftpd/proftpd"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.9e"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "proftpd: proftpd: Authorization bypass via mod_sftp copy-file extension", "id": "2563984", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563984"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-552", "details": ["ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.", "A flaw was found in ProFTPD. An authorization bypass vulnerability in the mod_sftp module fails to properly enforce write restrictions when handling file copy requests. An authenticated Secure File Transfer Protocol (SFTP) user can exploit this issue to copy readable files into write-restricted directories, resulting in unauthorized file creation where uploads are normally prohibited."], "name": "CVE-2026-119147", "public_date": "2026-10-30T11:30:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119147\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119147\nhttps://abraxaslabs.tech/research/proftpd-sftp-copy-file-write\nhttps://github.com/proftpd/proftpd\nhttps://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748\nhttps://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16\nhttps://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5\nhttps://github.com/proftpd/proftpd/releases/tag/v1.3.9e\nhttps://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires established user credentials and is restricted to duplicating existing readable files into restricted destinations rather than executing arbitrary commands or altering file contents arbitrarily. ProFTPD is not shipped or supported within Red Hat Enterprise Linux core repositories, though it is distributed via community channels such as Fedora and Extra Packages for Enterprise Linux (EPEL). Therefore, default Red Hat Enterprise Linux deployments are not affected by this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.3.10rc1,1.3.10rc5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ProFTPD", "source": "cna", "vendor": "ProFTPD Project"}, "product": "proftpd", "vendor": "proftpd"}], "created": "2026-10-30T13:00:15.129339+00:00", "updated": "2026-11-04T10:45:12.289130+00:00", "vendors": ["proftpd", "proftpd$PRODUCT$proftpd"]}