Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat vsftpd Service Allows Unauthorized File Access

published 9 months ago

Summary

A security update for vsftpd has been released to address a vulnerability that could allow an attacker to access files on the server without proper authorization. This affects systems running vsftpd, a popular FTP server software, and could potentially allow unauthorized access to sensitive files. Users should apply the update to ensure their systems are secure.

What to do

Update redhat vsftpd to version 0:3.0.5-6.el9_7.2.
Update redhat vsftpd-debuginfo to version 0:3.0.5-6.el9_7.2.
Update redhat vsftpd-debugsource to version 0:3.0.5-6.el9_7.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	vsftpd	< 0:3.0.5-6.el9_7.2 Fix: upgrade to 0:3.0.5-6.el9_7.2
Red Hat:enterprise_linux:9::appstream	redhat	vsftpd-debuginfo	< 0:3.0.5-6.el9_7.2 Fix: upgrade to 0:3.0.5-6.el9_7.2
Red Hat:enterprise_linux:9::appstream	redhat	vsftpd-debugsource	< 0:3.0.5-6.el9_7.2 Fix: upgrade to 0:3.0.5-6.el9_7.2

Original advisory text

Red Hat Security Advisory: vsftpd security update

References

https://access.redhat.com/errata/RHSA-2026:0605 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2419826 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0605.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-14242 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-14242 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14242 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Timeline

Published15 Jan 2026

Updated16 Mar 2026

First seen16 Mar 2026

Sources

RHSA-2026:0605 · OSV

Track software like this

Free during beta