WATCHExploited vulnerability
ProFTPD ProFTPD
ProFTPD Improper Access Control Vulnerability
What's happening and what to do
Remote attackers can read and write arbitrary files on the server through the site cpfr and site cpto commands, and this flaw is being actively exploited. ProFTPD (ProFTPD server; no versions given in the advisory). Apply the vendor's update now and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-10-08Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-10-11Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.