CVE-2026-119567
LOW
NVD
CVSS Score
3.1
Severity
LOW
Published
Oct 30, 2026
Vendor
unknown
Description
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.