CVE-2026-119567

A flaw was found in vsftpd. This vulnerability allows an authenticated remote attacker to bypass access control restrictions and execute denied operations. Because the service performs exact string matching against restricted command names without accounting for legacy command aliases defined in RFC 775, an attacker can submit equivalent X-prefixed commands to perform prohibited directory operations.

This vulnerability is rated as Low severity because exploitation requires an authenticated FTP session and only impacts deployments that rely on the cmds_denied configuration directive to restrict user actions. In standard Red Hat Enterprise Linux environments, operating system filesystem permissions, directory ownership controls, and SELinux policies remain in effect to restrict unauthorized modifications even if command-level filtering within the FTP daemon is circumvented.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent users from executing denied operations using RFC 775 command aliases, explicitly include both standard FTP commands and their X-prefixed aliases in the cmds_denied directive.

1. Edit /etc/vsftpd/vsftpd.conf and include the legacy aliases in the cmds_denied configuration setting:

cmds_denied=RMD,MKD,CWD,PWD,CDUP,XRMD,XMKD,XCWD,XPWD,XCUP

2. Restart the vsftpd service to apply the configuration:

systemctl restart vsftpd

Warning: Restarting the vsftpd service will terminate any active FTP sessions.

Operational hardening: Ensure that underlying directory permissions, ownership, and POSIX ACLs strictly enforce write and delete boundaries at the filesystem layer rather than relying exclusively on FTP application-level command filtering.