CVE-2026-119567

3.1 LOW

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-184

All references

https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias
https://security.appspot.com/vsftpd.html
https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100253
HIGHCVE-2026-101882PoC
HIGHCVE-2026-101884PoC
MEDIUMCVE-2026-102087
UNSCOREDCVE-2026-102828PoC
UNSCOREDCVE-2026-102829PoC
HIGHCVE-2026-103687PoC
UNSCOREDCVE-2026-104024PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.