What is CVE-2026-119567?

CVE-2026-119567 is a low-severity vulnerability in Vsftpd, classified under Incomplete List of Disallowed Inputs. CVSS score: 3.1/10. Published 2026-10-30.

How severe is CVE-2026-119567?

Low severity. CVSS v3 base score is 3.1 out of 10.

Vulnerability in Vsftpd

CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

Published 2026-10-30 · last modified 2026-10-30.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Vsftpd

Weakness classification (CWE)

CWE-184 — Incomplete List of Disallowed Inputs

References

abraxaslabs.tech/research/vsftpd-cmds-denied-alias (third-party-advisory)
security.appspot.com/vsftpd.html (product)
www.vulncheck.com/advisories/vsftpd-through-3.0.5-cmds-denied-bypass-via-rfc-77… (third-party-advisory)

Frequently asked questions

What is CVE-2026-119567?: CVE-2026-119567 is a low-severity vulnerability in Vsftpd, classified under Incomplete List of Disallowed Inputs. CVSS score: 3.1/10. Published 2026-10-30.
How severe is CVE-2026-119567?: Low severity. CVSS v3 base score is 3.1 out of 10.