CVE-2026-35025: ProFTPD Auth Bypass Vulnerability

CVE-2026-35025 Overview

CVE-2026-35025 is an access control bypass vulnerability in ProFTPD through versions 1.3.9b and 1.3.10rc2. Authenticated FTP users can circumvent Directory Access Control List (ACL) restrictions by prefixing paths with /proc/self/root in the RNFR (rename from) command handler. The flaw resides in path canonicalization logic, where dir_canonical_path() fails to resolve symlink components before dir_check() performs lexical path comparisons. Attackers can rename files inside DenyAll-protected directories and subsequently retrieve them, breaking the confidentiality and integrity guarantees of ACL configurations. The vulnerability is categorized under [CWE-59] (Link Following).

Critical Impact
Authenticated FTP users can bypass Directory ACL restrictions to read and rename files in directories protected by DenyAll, exposing sensitive data on affected ProFTPD deployments.

Affected Products

ProFTPD versions through 1.3.9b
ProFTPD 1.3.10rc2
Deployments not using DefaultRoot (chroot) configuration

Discovery Timeline

2026-06-24 - CVE-2026-35025 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-35025

Vulnerability Analysis

ProFTPD enforces Directory-based access control through configuration blocks that match canonicalized request paths. When a client issues an RNFR command, the server passes the target path to dir_canonical_path() for normalization before dir_check() evaluates it against configured <Directory> blocks. The canonicalization routine performs lexical resolution but does not resolve symbolic link components in the path. The Linux pseudo-file /proc/self/root is a symlink pointing to the filesystem root for the current process. By prefixing a target path with /proc/self/root, an authenticated attacker produces a string that the canonicalizer treats as a literal absolute path. The string fails to match any configured <Directory> block, so dir_check() returns success and the ACL is skipped. The kernel later resolves the symlink during the actual filesystem operation, allowing the rename to act on the real protected file. After renaming the file into an attacker-controlled location, the attacker retrieves the contents through a standard RETR operation.

Root Cause

The root cause is inconsistent path resolution between the access control layer and the filesystem layer. dir_canonical_path() performs lexical normalization without resolving symlink components, while the kernel honors symlinks at operation time. This [CWE-59] symbolic link following condition produces a TOCTOU-style discrepancy where authorization checks operate on a different effective path than the executed syscall.

Attack Vector

Exploitation requires valid FTP credentials and network access to the ProFTPD service. The attacker authenticates, then issues an RNFR command targeting a path such as /proc/self/root/etc/protected/secret.conf. The server's ACL engine matches no <Directory> block for that lexical path and permits the operation. The attacker follows with RNTO to move the file into a readable directory, then issues RETR to download it. Sessions configured with DefaultRoot (chroot) are not affected because chroot changes the directory to which /proc/self/root resolves, neutralizing the prefix trick.

No verified proof-of-concept code is publicly attached to this advisory. Refer to the VulnCheck ProFTPD ACL Bypass Advisory and GitHub ProFTPD Issue #2170 for technical context.

Detection Methods for CVE-2026-35025

Indicators of Compromise

FTP session logs containing RNFR commands with arguments beginning with /proc/self/root or other symlink-prefixed absolute paths.
Unexpected RNFR followed by RNTO sequences that move files out of directories normally protected by DenyAll.
RETR operations downloading files that were renamed seconds earlier from administrative or restricted paths.

Detection Strategies

Parse ProFTPD TransferLog and ExtendedLog entries for path arguments containing /proc/, /proc/self/, or other procfs references in FTP command parameters.
Correlate RNFR/RNTO/RETR command sequences per session and alert when rename targets cross directory boundaries defined in <Directory> blocks.
Baseline normal FTP command argument patterns per user account and flag deviations involving pseudo-filesystem paths.

Monitoring Recommendations

Enable verbose FTP command logging with ExtendedLog capturing the AUTH, INFO, and WRITE command classes.
Forward FTP logs to a centralized log analytics or SIEM platform and apply detection rules for procfs path prefixes in protocol arguments.
Monitor for unexpected file modifications and ownership changes in directories declared with DenyAll in ProFTPD configuration.

How to Mitigate CVE-2026-35025

Immediate Actions Required

Inventory all ProFTPD instances and identify versions at or below 1.3.9b and 1.3.10rc2.
Apply DefaultRoot ~ or an explicit chroot path to all user classes that do not require global filesystem visibility, which neutralizes the /proc/self/root prefix.
Restrict FTP access at the network layer to authorized client ranges until a patched build is deployed.
Audit recent FTP logs for RNFR commands referencing /proc/self/root and review file integrity in ACL-protected directories.

Patch Information

At time of publication, the upstream fix is being tracked in GitHub ProFTPD Issue #2170. Monitor the ProFTPD Official Website and the VulnCheck ProFTPD ACL Bypass Advisory for release announcements and updated packages from Linux distributions.

Workarounds

Configure DefaultRoot ~ globally in proftpd.conf to chroot all sessions; chroot makes /proc/self/root resolve to the jailed directory and prevents the bypass.
Disable the RNFR/RNTO command pair for untrusted user classes using <Limit RNFR RNTO> blocks with DenyAll where rename functionality is not required.
Remove or restrict shell-level execute permission on /proc/self for the FTP service account where operationally feasible.

bash

# Configuration example: chroot all FTP sessions in proftpd.conf
DefaultRoot ~

# Restrict rename commands for an anonymous user class
<Anonymous /var/ftp>
  <Limit RNFR RNTO>
    DenyAll
  </Limit>
</Anonymous>