{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119567", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T10:53:32.356Z", "datePublished": "2026-10-30T11:31:13.756Z", "dateUpdated": "2026-10-30T11:31:13.756Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:31:13.756Z"}, "datePublic": "2026-10-12T00:00:00.000Z", "title": "vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases", "descriptions": [{"lang": "en", "value": "vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incomplete List of Disallowed Inputs", "cweId": "CWE-184", "type": "CWE"}]}], "affected": [{"vendor": "vsftpd", "product": "vsftpd", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "3.0.5", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.0.5"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW"}}], "references": [{"url": "https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias", "tags": ["third-party-advisory"]}, {"url": "https://security.appspot.com/vsftpd.html", "tags": ["product"]}, {"name": "VulnCheck Advisory: vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases"}], "credits": [{"lang": "en", "value": "Abraxas Labs", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "vsftpd", "vendor": "vsftpd", "versions": [{"lessThanOrEqual": "3.0.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories."}], "id": "CVE-2026-119567", "lastModified": "2026-10-30T19:21:43.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-30T12:16:44.433", "references": [{"source": "disclosure@vulncheck.com", "url": "https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias"}, {"source": "disclosure@vulncheck.com", "url": "https://security.appspot.com/vsftpd.html"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "vsftpd: vsftpd: access control bypass via RFC 775 command aliases", "id": "2563946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563946"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-184", "details": ["A flaw was found in vsftpd. This vulnerability allows an authenticated remote attacker to bypass access control restrictions and execute denied operations. Because the service performs exact string matching against restricted command names without accounting for legacy command aliases defined in RFC 775, an attacker can submit equivalent X-prefixed commands to perform prohibited directory operations."], "name": "CVE-2026-119567", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "vsftpd", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "vsftpd", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "vsftpd", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "vsftpd", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "vsftpd", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-30T11:31:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119567\nhttps://abraxaslabs.tech/research/vsftpd-cmds-denied-alias\nhttps://security.appspot.com/vsftpd.html\nhttps://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.5]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "vsftpd", "source": "cna", "vendor": "vsftpd"}, "product": "vsftpd", "vendor": "vsftpd_project"}], "created": "2026-10-30T12:45:12.991032+00:00", "updated": "2026-10-30T16:30:15.419286+00:00", "vendors": ["vsftpd_project", "vsftpd_project$PRODUCT$vsftpd"]}