CVE-2026-35025: 
NixOS vulnerability analysis and mitigation

CVE-2026-35025 is an access control bypass vulnerability in ProFTPD that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. It affects ProFTPD through version 1.3.9b and release candidates up to 1.3.10rc2. The vulnerability was publicly disclosed on June 24, 2026, with the GitHub issue and advisory published the same day (GitHub Issue, GitHub Advisory). It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). The flaw resides in the RNFR command handler: when a path is prefixed with /proc/self/root, the dir_canonical_path() function fails to fully resolve the symlink components, causing dir_check() to perform a purely lexical path comparison that does not match any configured <Directory> block. This allows the attacker to bypass DenyAll ACL protections and issue rename operations (RNFR/RNTO) on files in restricted directories, after which those files can be retrieved. Exploitation requires valid FTP credentials but no elevated privileges beyond a standard authenticated session (GitHub Issue, GitHub Advisory).

A successful exploit allows an authenticated FTP user to rename files residing in DenyAll-protected directories and subsequently retrieve them, resulting in high confidentiality and integrity impact. Sensitive files that administrators intended to protect via Directory ACLs can be exposed or modified without authorization. Availability is not directly impacted, and the vulnerability scope is limited to the vulnerable system itself. Sessions configured with DefaultRoot (chroot) are not affected, as the chroot environment changes the target of the /proc/self/root symlink (GitHub Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as 'none' and the attack as non-automatable, reflecting the requirement for valid FTP credentials. The EPSS score is approximately 0.345%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify ProFTPD servers running versions ≤1.3.9b or 1.3.10rc1/rc2 using banner grabbing tools (e.g., nmap -sV -p 21 <target>) and confirm the server is not configured with DefaultRoot (chroot).
2. Authenticate: Log in to the FTP server using valid credentials (any authenticated user account suffices).
3. Identify a restricted target file: Enumerate the server to locate files within directories protected by <Directory> blocks with DenyAll or similar restrictive ACLs.
4. Craft the RNFR command: Issue an RNFR command with the target file path prefixed by /proc/self/root, e.g., RNFR /proc/self/root/restricted/secret.txt. This causes dir_canonical_path() to leave symlink components unresolved, making dir_check() perform a lexical comparison that matches no configured <Directory> block, effectively bypassing the ACL.
5. Complete the rename: Issue a corresponding RNTO command to rename the file to a location accessible to the authenticated user, e.g., RNTO /public/secret.txt.
6. Retrieve the file: Use a standard RETR command or passive download to retrieve the renamed file from the accessible location, obtaining the previously protected content (GitHub Issue, GitHub Advisory).

• Network: FTP sessions containing RNFR commands with paths prefixed by /proc/self/root (e.g., RNFR /proc/self/root/...); unusual RNTO commands moving files from restricted directories to publicly accessible paths.
• Logs: ProFTPD access logs (/var/log/proftpd/xferlog or proftpd.log) showing RNFR /proc/self/root/ entries followed by RNTO and RETR commands for files that should be inaccessible to the authenticated user; repeated failed or successful rename attempts on protected directories.
• File System: Files appearing in publicly accessible FTP directories that were previously only present in ACL-restricted directories; unexpected modification timestamps on files in DenyAll-protected paths.

The primary workaround is to configure all FTP sessions with DefaultRoot (chroot), which changes the directory to which /proc/self/root resolves and prevents exploitation of this bypass (GitHub Issue, GitHub Advisory). Administrators should add DefaultRoot ~ (or an appropriate chroot path) to their proftpd.conf for all user sessions. A patched release version has not yet been specified in available advisories; administrators should monitor the ProFTPD project and the VulnCheck advisory for patch availability and upgrade as soon as a fixed version is released (Red Hat Bugzilla).

The vulnerability was reported to the ProFTPD project via email before public disclosure, with the reporter (djnnvxop) opening a public GitHub issue on June 24, 2026, to formally document the flaw (GitHub Issue). Red Hat tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). Security news outlet SecurityOnline.info covered the vulnerability shortly after disclosure (SecurityOnline). No significant social media controversy or broad community debate has been observed beyond standard vulnerability tracking.