CVE-2026-119567
Description
A flaw was found in vsftpd. This vulnerability allows an authenticated remote attacker to bypass access control restrictions and execute denied operations. Because the service performs exact string matching against restricted command names without accounting for legacy command aliases defined in RFC 775, an attacker can submit equivalent X-prefixed commands to perform prohibited directory operations.
Statement
This vulnerability is rated as Low severity because exploitation requires an authenticated FTP session and only impacts deployments that rely on the cmds_denied configuration directive to restrict user actions. In standard Red Hat Enterprise Linux environments, operating system filesystem permissions, directory ownership controls, and SELinux policies remain in effect to restrict unauthorized modifications even if command-level filtering within the FTP daemon is circumvented.
Mitigation
To prevent users from executing denied operations using RFC 775 command aliases, explicitly include both standard FTP commands and their X-prefixed aliases in the `cmds_denied` directive.
1. Edit `/etc/vsftpd/vsftpd.conf` and include the legacy aliases in the `cmds_denied` configuration setting:
cmds_denied=RMD,MKD,CWD,PWD,CDUP,XRMD,XMKD,XCWD,XPWD,XCUP
2. Restart the vsftpd service to apply the configuration:
systemctl restart vsftpd
Warning: Restarting the `vsftpd` service will terminate any active FTP sessions.
Operational hardening:
Ensure that underlying directory permissions, ownership, and POSIX ACLs strictly enforce write and delete boundaries at the filesystem layer rather than relying exclusively on FTP application-level command filtering.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.1 | N/A | 3.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
