mirror of
https://github.com/cloudpanel-io/cloudpanel-ce.git
synced 2026-04-05 20:31:58 +02:00
Possible Vulnerability with ProFTPD - Site User Account Accessing Root Directory #114
Assignees
MrUnknownDE
Clear assignees
MrUnknownDE
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github/cloudpanel-ce#114
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ipelweb on 3/26/2025
CloudPanel version(s) affected
2.5.1-4
Description
I’m testing CloudPanel for the first time and I really like it! Great work!
However, I noticed an issue when logging in via FTP with the site user account: it allows access to all server files, up to the root directory.
The site user account should be restricted to accessing only the site's files (/home/xxx) and not the entire server directory structure.
This issue doesn’t occur when creating and using a "normal" FTP User.
I'm not an expert, maybe it's not even a bug, just want to let you know this.
How to reproduce
Log in via FTP using the site user account in FileZilla.
After logging in, click the "up one level" button (the two dots) to navigate to the parent directory.
You will be able to access the server root directory and view/edit all server files.
This issue does not occur if you create and use a dedicated FTP account.
Possible Solution
I resolved this by editing the ProFTPD configuration file located at:
/etc/proftpd/proftpd.conffrom
DefaultRoot ~ ftp-userto
DefaultRoot ~Additional Context
No response