{"id":"AZL-111796","summary":"CVE-2026-119567 affecting package vsftpd 3.0.5-1","details":"vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.","modified":"2026-10-31T14:17:40.499826687Z","published":"2026-10-30T12:16:44Z","upstream":["CVE-2026-119567"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119567"}],"affected":[{"package":{"name":"vsftpd","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/vsftpd"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.5-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111796.json"}}],"schema_version":"1.9.2"}