{"id":"CVE-2026-119567","aliases":[],"cve":{"records":[{"id":"CVE-2026-119567","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T10:53:32.356Z","published":"2026-10-30T11:31:13.756Z","modified":"2026-11-05T21:23:32.044Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T11:31:13.756Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T21:23:32.044Z"}],"references":[{"url":"https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://security.appspot.com/vsftpd.html","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-184","description":"Incomplete List of Disallowed Inputs","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*","versionEndIncluding":"3.0.5"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T21:22:04.816644Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.","score":3.1,"severity":"low","published":"2026-10-30T11:31:13.756Z","modified":"2026-11-05T21:23:32.044Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"vsftpd","name":"vsftpd","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.0.5","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119567"}],"remediation":[],"references":["https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias","https://security.appspot.com/vsftpd.html","https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases"],"sources":[{"name":"CVE","id":"CVE-2026-119567","modified":"2026-11-05T21:23:32.044Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119567"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.1}],"sourceAffected":[],"observedAt":"2026-11-05T23:53:06.841Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T11:40:33.336Z","attemptedAt":"2026-10-30T11:40:33.336Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T11:40:33.639Z","attemptedAt":"2026-10-30T11:40:33.639Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T11:40:31.785Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T11:40:33.278Z","attemptedAt":"2026-10-30T11:40:33.278Z"}],"evidence":[],"aiSummary":{"text":"vsftpd through 3.0.5 has an access control bypass vulnerability, allowing authenticated FTP users to execute denied commands using RFC 775 X-prefixed aliases. The cmds_denied check is bypassed by sending aliases like XRMD or XMKD. This affects vsftpd versions less than or equal to 3.0.5.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T11:41:20.750Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119567"}]}}