CVE-2026-119147
Description
A flaw was found in ProFTPD. An authorization bypass vulnerability in the mod_sftp module fails to properly enforce write restrictions when handling file copy requests. An authenticated Secure File Transfer Protocol (SFTP) user can exploit this issue to copy readable files into write-restricted directories, resulting in unauthorized file creation where uploads are normally prohibited.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires established user credentials and is restricted to duplicating existing readable files into restricted destinations rather than executing arbitrary commands or altering file contents arbitrarily. ProFTPD is not shipped or supported within Red Hat Enterprise Linux core repositories, though it is distributed via community channels such as Fedora and Extra Packages for Enterprise Linux (EPEL). Therefore, default Red Hat Enterprise Linux deployments are not affected by this flaw.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Files or Directories; Modify Files or Directories
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
