Threats affecting pkg:github/ProFTPD

CVE-2026-119364 is a link-following vulnerability in ProFTPD's mod_copy module affecting versions up to 1.3.9e and 1.3.10rc1 through 1.3.10rc4. Authenticated FTP users can exploit this flaw to bypass write restrictions by creating symbolic links in writable directories and using SITE COPY or SITE CPTO commands to overwrite files in locations where write access is normally denied. The issue is fixed in version 1.3.10rc5.

CVE-2026-119147 is an authorization bypass vulnerability in ProFTPD versions before 1.3.9e and 1.3.10rc5. It affects the mod_sftp copy-file extension handler, allowing authenticated SFTP users to copy readable files to new locations in directories where write permissions are denied. This bypasses the intended Limit WRITE checks, enabling unauthorized file creation in restricted directories.

CVE-2026-119146 is a buffer overflow vulnerability in ProFTPD versions before 1.3.9e and 1.3.10rc5. It occurs in the mod_rewrite int:utf8trans RewriteMap, allowing remote attackers to send FTP command arguments longer than 1024 bytes to overwrite static buffers. This can corrupt session memory and crash the session, potentially without authentication if pre-login commands are rewritten.

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.