Technical impact
A path handling flaw in ProFTPD versions 1.3.9b through 1.3.10rc2 allows an authenticated FTP user to prefix a file path with /proc/self/root in an RNFR command. The vulnerability exploits unresolved symlink components in dir_canonical_path(), causing dir_check() to perform lexical comparisons that do not match any configured Directory block. The result is that the attacker can rename and subsequently download files located in directories protected by a DenyAll ACL. The weakness is a classic path traversal (CWE‑59) that leads to a breach of confidentiality, integrity, and potentially availability if the attacker modifies file permissions or contents. Based on the description, it is inferred that the exploitation path is straightforward because it requires only a single crafted RNFR command after authentication.
Affected Systems
The affected vendor is ProFTPD Project, specifically the ProFTPD server versions 1.3.9b and 1.3.10rc2. Versions older than 1.3.9b or newer than 1.3.10rc2 are not confirmed to be vulnerable. All user sessions that employ the DefaultRoot directive (chroot) are not impacted, as chroot confines /proc/self/root to the user's chrooted environment.
Risk and Exploitability
The CVSS score of 8.6 indicates high severity, and the EPSS score is not available, suggesting limited publicly known exploitation data. The lack of a listing in the CISA KEV catalog further indicates that no widespread exploitation has been reported. An attacker must first authenticate to the FTP server before issuing a crafted RNFR command; based on the description, it is inferred that the exploitation path is relatively low complexity, raising the likelihood of successful attacks. This vulnerability allows bypass of ACL restrictions to access protected files, posing a significant risk to any environment running the affected ProFTPD releases.
