ProFTPD versions 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contain a flaw in the mod_copy component that follows symbolic links when executing SITE COPY or SITE CPTO commands. Authenticated FTP users can place a symlink in a writable directory and then instruct the server to copy content to the link target, thereby overwriting files in locations that are otherwise write‑prohibited. The compromise affects integrity and confidentiality of files outside the user’s write permissions, but does not provide remote code execution or arbitrary command execution. The attack requires an authenticated session and the ability to create a symlink in a writable directory.

ProFTPD Project:ProFTPD, versions 1.3.9e and 1.3.10rc1–rc4. The vulnerable functionality is limited to the mod_copy module and the SITE COPY/CPTO FTP commands.

The CVSS score of 6.0 classifies this vulnerability as medium severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The required conditions are an active FTP session with write access in a directory where symlinks can be created. An attacker can exploit the flaw by crafting a symlink to a sensitive file and issuing a SITE COPY or CPTO command, resulting in unauthorized file overwrite. The lack of remote code execution limits the impact to controlled file modifications, but the ability to alter system or application files can facilitate further attacks if privileges are elevated. The attack vector is internal to the FTP service and does not require network-level access beyond the authenticated FTP session.