CVE-2026-35025: ProFTPD Access Control Bypass via /proc/self/root Symlink Exploitation

Technical summary

The vulnerability resides in ProFTPD's directory access control mechanism. Specifically, the dir_canonical_path() function fails to properly resolve symlink components when processing paths prefixed with /proc/self/root in RNFR (rename from) commands. This causes dir_check() to perform lexical path comparisons that match no configured Directory block in the ACL ruleset. As a result, DenyAll-protected directories are not matched against, and the rename operation proceeds when it should be blocked. Authenticated users can then rename files into accessible locations and retrieve them. The issue is classified as an improper link resolution vulnerability (CWE-59). Sessions configured with DefaultRoot (which implements chroot) are unaffected because chroot changes the directory context to which /proc/self/root resolves, breaking the attack path.

Business impact

This vulnerability represents a confidentiality and integrity risk for organizations running vulnerable ProFTPD instances with complex access control policies. An authenticated attacker—either a compromised legitimate user account or an attacker with valid credentials—can exfiltrate files that should be protected by directory ACLs. For organizations using FTP for file storage or distribution, this could expose sensitive documents, source code, or customer data. The integrity impact stems from the ability to rename files, potentially disrupting file organization or overwriting legitimate files. Organizations without chroot protection are at greatest risk.

Affected systems

ProFTPD versions 1.3.9b and earlier, and 1.3.10rc2, are affected. The vulnerability requires an authenticated FTP session, so it does not pose a risk to unauthenticated access attempts. Mitigation is automatic for deployments configured with DefaultRoot (chroot), which is a common security hardening practice but not universally deployed. Organizations should verify their ProFTPD version and configuration to determine exposure.

Exploitability

Exploitation requires valid FTP credentials and an active session—this is not an unauthenticated remote code execution vulnerability. The attack is straightforward once authenticated: an attacker simply needs to craft RNFR commands with /proc/self/root-prefixed paths to bypass ACL checks. The low complexity (AC:L in the CVSS vector) reflects that no special conditions or race conditions are needed. No public exploits have been added to the CISA KEV catalog as of the latest update, but the simplicity of the technique means defenders should assume capability could be developed or already exists in targeted attacks.

Remediation

Upgrade ProFTPD to a patched version that properly resolves symlink components in the dir_canonical_path() function. Verify against the vendor advisory for the specific version number that addresses this issue. As an interim mitigation, enable DefaultRoot (chroot) if your FTP deployment supports it; this immediately neutralizes the attack vector. Additionally, restrict FTP access to trusted networks and enforce strong credential management to reduce the risk of unauthorized authenticated sessions.

Patch guidance

Contact ProFTPD or monitor their official advisory channels for a patched release that fixes the dir_canonical_path() symlink resolution flaw. When patching is available, test it in a non-production environment to confirm that your Directory ACL rules remain effective and that FTP functionality is not disrupted. If immediate patching is not possible, prioritize enabling DefaultRoot in your ProFTPD configuration as a compensating control. Verify your configuration matches vendor recommendations before deploying to production.

Detection guidance

Monitor FTP logs for RNFR commands that include unusual path prefixes such as /proc/self/root or other symlink-related patterns. Alert on rename operations that involve paths outside the user's expected working directories. If supported by your FTP server logging, capture both the rename-from and rename-to paths for forensic analysis. Check for unexpected file modifications or deletions in DenyAll-protected directories. Review FTP user session logs to identify accounts making repeated ACL bypass attempts, which may indicate reconnaissance or active exploitation.

Why prioritize this

This vulnerability scores 8.1 (HIGH) due to the combination of authenticated access (reducing the attack surface), high confidentiality and integrity impact (files can be exfiltrated and renamed), and low attack complexity. It is not yet in the CISA KEV catalog, suggesting limited active exploitation so far, but the technique is simple enough to be weaponized quickly. Organizations should prioritize patching or implementing the DefaultRoot mitigation within 30 days, especially those with sensitive data in FTP-accessible locations or those subject to compliance requirements around data access controls.

Risk score, explained

CVSS 3.1 score of 8.1 reflects the HIGH severity. The attack vector is network-based (AV:N), requires low attack complexity (AC:L), and demands authenticated privileges (PR:L). The scope is unchanged (S:U), meaning the impact is limited to the FTP service itself, not the broader system. High confidentiality and integrity impacts (C:H/I:H) are balanced by no availability impact (A:N), since the attack does not cause denial of service. The score appropriately prioritizes this above medium-severity vulnerabilities but below critical flaws that affect unauthenticated users or cause system unavailability.

Frequently asked questions