EUVD lists vsftpd access control bypass (EUVD-2026-113832)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- vsftpd
- Product
- vsftpd
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-113832, shared in a Mastodon post, describes an access control bypass in vsftpd through 3.0.5. It rates the flaw 2.3/10 (CVSS v3.1) and says authenticated FTP users can run denied commands using X-prefixed aliases.
If you use vsftpd
Check whether your vsftpd version is 3.0.5 or earlier.
Update vsftpd to a fixed release when the vendor publishes one.
Limit FTP accounts to the commands they need.
Check whether your vsftpd version is 3.0.5 or earlier, and whether FTPS is enabled.
Update vsftpd to a fixed release as soon as the vendor publishes one.
Restrict FTP access to trusted source IPs until patched.
What the sources say 2
· Mastodon: “vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket.” Source
· Mastodon: “vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases.” Source