---
id: CVE-2026-119567
title: vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
summary: >-
  vsftpd through 3.0.5 contains an access control bypass vulnerability that
  allows authenticated FTP users to execute denied commands by issuing RFC 775
  X-prefixed aliases. The cmds_denied check in process_post_login() compares
  literal tok…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-184
vendor: vsftpd
product: vsftpd
affected:
  - vsftpd <= 3.0.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:22:04.816644Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:32.044Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119567'
references:
  - url: 'https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias'
  - url: 'https://security.appspot.com/vsftpd.html'
  - url: >-
      https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-775-command-aliases
    label: >-
      VulnCheck Advisory: vsftpd through 3.0.5 cmds_denied Bypass via RFC 775
      Command Aliases
tags:
  - cve.org
epss: 0.00217
epssPercentile: 0.12238
ingestedAt: '2026-11-03T11:43:15.776Z'
---

## Overview

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

## Affected

- `vsftpd <= 3.0.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.