ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2994824419 advisory.

    This update adds a new module, `mod_procfs`, which is enabled by default. It addressses CVE-2026-35025     (ACL bypass via `/proc/self/root` path prefix), by disallowing any file accesses via `procfs` filesystems.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d314ce6051 advisory.

    This update adds a new module, `mod_procfs`, which is enabled by default. It addressses CVE-2026-35025     (ACL bypass via `/proc/self/root` path prefix), by disallowing any file accesses via `procfs` filesystems.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows     authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root     in the RNFR command handler. Attackers can exploit the unresolved symlink components in     dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured     Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent     retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as     chroot changes the directory to which /proc/self/root resolves. (CVE-2026-35025)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330823	Fedora 44 : proftpd (2026-2994824419)	Nessus	Fedora Local Security Checks	high
330767	Fedora 43 : proftpd (2026-d314ce6051)	Nessus	Fedora Local Security Checks	high
322671	Linux Distros Unpatched Vulnerability : CVE-2026-35025	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35025

high

Tenable Plugins

high

high

high