Hi,

The following vulnerability was published for proftpd-dfsg.

CVE-2026-119364[0]:
| ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a
| link-following vulnerability in mod_copy that allows authenticated
| FTP users to bypass Limit WRITE restrictions via symlinks. Attackers
| can place a symlink in a writable directory and use SITE COPY or
| SITE CPTO to overwrite files in write-denied locations.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-119364
https://www.cve.org/CVERecord?id=CVE-2026-119364
[1] https://github.com/proftpd/proftpd/issues/2374
[2] https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
proftpd-dfsg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152788@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hilmar Preuße <hille42@debian.org> (supplier of updated proftpd-dfsg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 01 Nov 2026 19:24:16 +0100
Source: proftpd-dfsg
Architecture: source
Version: 1.3.9e~dfsg-3
Distribution: unstable
Urgency: high
Maintainer: ProFTPD Maintainance Team <pkg-proftpd-maintainers@alioth-lists.debian.net>
Changed-By: Hilmar Preuße <hille42@debian.org>
Closes: 1152788
Changes:
 proftpd-dfsg (1.3.9e~dfsg-3) unstable; urgency=high
 .
   * Apply patch to disable inet_connect_ipv6_test (fails on s390x).
   * Apply patch to fix issue #2374 / CVE-2026-119364 (Closes: #1152788).
Checksums-Sha1:
 fe4c0373bbb5926af8bd5da6e8e110653489998a 2850 proftpd-dfsg_1.3.9e~dfsg-3.dsc
 a655e121512e990ed22393f076413fc990b6711c 78772 proftpd-dfsg_1.3.9e~dfsg-3.debian.tar.xz
 1a6914617cad4f1e688e925cb1d942f458fb1c38 5120 proftpd-dfsg_1.3.9e~dfsg-3_source.buildinfo
Checksums-Sha256:
 cbdd8de4fa68fb2098f21677e63e8e08ecc601c78d1c3024c52ddfd98a44b11b 2850 proftpd-dfsg_1.3.9e~dfsg-3.dsc
 ac9b8af880f2003a52564a5f0904063d01aead4c6c5d431497c379d5f0cb1e1d 78772 proftpd-dfsg_1.3.9e~dfsg-3.debian.tar.xz
 9851000727fad3dbf0abaaaddc32be74e6291dfa551390427d5b2f5f4e407a3a 5120 proftpd-dfsg_1.3.9e~dfsg-3_source.buildinfo
Files:
 7a8898edc8ac7f41bbc6857867d58544 2850 net optional proftpd-dfsg_1.3.9e~dfsg-3.dsc
 48b117aac813a71ea5688e8a4e15dc30 78772 net optional proftpd-dfsg_1.3.9e~dfsg-3.debian.tar.xz
 e0d3a2ffcecfa3848c5a0a997f71e0ce 5120 net optional proftpd-dfsg_1.3.9e~dfsg-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRKnq6Z0VRDf4bMmAn98EQ6ARgcNAUCaueEW18UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NEE5
RUFFOTlEMTU0NDM3Rjg2Q0M5ODA5RkRGMDQ0M0EwMTE4MUMzNAAKCRD98EQ6ARgc
NIOgAQDlj1bs1ecNf83+iB64Zllu+4vNGZTliA5IpOoay74urAEAyFZH/Rsakf7C
AF26GEU+gsd0+4kQ66xKSh75AxPdlQo=
=tB9o
-----END PGP SIGNATURE-----