high8.1Public exploit code
CVE-2026-42167
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE2026-08-25 · remote · multiple
Impact
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Proftpd | Proftpd | through 1.3.9b |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1
- https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
- https://github.com/proftpd/proftpd/issues/2052
- https://www.openwall.com/lists/oss-security/2026/05/01/4
- https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
- http://www.openwall.com/lists/oss-security/2026/05/01/13
- http://www.openwall.com/lists/oss-security/2026/05/01/4
- https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc