CVE-2026-119147— ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

Quick assessment

Affected

ProFTPD Project ProFTPD

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ProFTPD 1.3.9e 之前版本以及 1.3.10rc5 版本中，mod_sftp 模块的“复制文件”扩展处理器存在授权绕过漏洞。该漏洞会导致在创建新目标文件时跳过对指令的检查。已认证的 SFTP 用户因此能够将任何可读文件复制到写入权限被拒绝的目录中的新路径，从而在禁止上传的目录中创建文件。

CVSS 4.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1565.003 · Runtime Data Manipulation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ProFTPD Project	ProFTPD	0 ~ 1.3.9e	-

II. Public POCs for CVE-2026-119147

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119147

请登录查看更多情报信息。

Other References for CVE-2026-119147 (6)

ProFTPD SFTP copy-file skips dest WRITE · Abraxas Labs third-party-advisory
When an authenticated user invokes the SFTP "copy-file" extension and… · proftpd/proftpd@b7d3de4 · GitHub patch
https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748 technical-description
🔗 Release v1.3.9e · proftpd/proftpd · GitHub release-notes
🔗 Release v1.3.10rc5 · proftpd/proftpd · GitHub release-notes
ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119147

Same Patch Batch · ProFTPD Project · 2026-10-30 · 3 CVEs total

CVE-2026-119146	5.6 MEDIUM	ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap
CVE-2026-119364	5.3 MEDIUM	ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass

IV. Related Vulnerabilities

Same product: ProFTPD

Same vendor: ProFTPD Project

Same weakness: CWE-863