Source: proftpd-dfsg Version: 1.3.9d~dfsg-1 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream Forwarded: https://github.com/proftpd/proftpd/issues/2374
Hi, The following vulnerability was published for proftpd-dfsg. CVE-2026-119364[0]: | ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a | link-following vulnerability in mod_copy that allows authenticated | FTP users to bypass Limit WRITE restrictions via symlinks. Attackers | can place a symlink in a writable directory and use SITE COPY or | SITE CPTO to overwrite files in write-denied locations. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-119364 https://www.cve.org/CVERecord?id=CVE-2026-119364 [1] https://github.com/proftpd/proftpd/issues/2374 [2] https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af Please adjust the affected versions in the BTS as needed. Regards, Salvatore
