CVE-2026-119567

A flaw was found in vsftpd. This vulnerability allows an authenticated remote attacker to bypass access control restrictions and execute denied operations. Because the service performs exact string matching against restricted command names without accounting for legacy command aliases defined in...

CVE-2026-119567 vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmdsdenied check in processpostlogin compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to...

CVE-2026-119567

The vsftpd software (versions through 3.0.5 ) is vulnerable to an access control bypass because the cmds_denied check in process_post_login() only validates literal tokens. This allows authenticated users to bypass command restrictions by using RFC 775 X-prefixed aliases . Attackers can execute p...