---
id: CVE-2026-35025
title: >-
  ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass
  vulnerability that allows authenticated FTP users to circumvent Directory ACL
  restrictions by prefixing paths with /proc/self/root in the RNFR command
  handler
summary: >-
  ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass
  vulnerability that allows authenticated FTP users to circumvent Directory ACL
  restrictions by prefixing paths with /proc/self/root in the RNFR command
  handler. Attack…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-59
vendor: proftpd
product: proftpd
affected:
  - proftpd <= 1.3.9b
  - proftpd = 1.3.10
published: '2026-06-24'
updated: '2026-07-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35025'
references:
  - url: 'http://www.proftpd.org/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/proftpd/proftpd/issues/2170'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/proftpd-acl-bypass-via-proc-self-root-path-prefix-in-rnfr
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00505
epssPercentile: 0.40572
ingestedAt: '2026-07-03T13:02:27.989Z'
---

## Overview

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.

## Affected

- `proftpd <= 1.3.9b`
- `proftpd = 1.3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.