vsftpd up to version 3.0.5 contains an access control bypass that allows any authenticated FTP user to execute commands that are normally blocked, such as directory deletion or movement, by using RFC 775 X-prefixed aliases. These aliases are matched literally in the cmds_denied check, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to carry out operations that the server attempts to deny. The vulnerability is a result of improper command alias validation (CWE‑184).

The affected software is the vsftpd project’s vsftpd server, specifically all releases up to and including 3.0.5. The vulnerability affects authenticated FTP users on any system running these versions, regardless of operating system, as the issue resides in the vsftpd code.

The CVSS score is 2.3, indicating low severity, and the EPSS score is not available, so current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no widespread or confirmed exploitation. Attackers must possess valid FTP credentials to exploit the bug; they can issue aliased commands to bypass the denied command list. Because the user must already be authenticated, the risk of remote compromise is limited to the privileges granted to that FTP account, but they can still delete or modify directories they normally cannot remove.