CVEvulnerability
CVE-2026-42167
8.1 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-28
- Last modified
- 2026-07-24
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
Description
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
Affected configurations
• proftpd proftpd (<= 1.3.9b)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1 Release Notes
- https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc Exploit, Third Party Advisory
- https://github.com/proftpd/proftpd/issues/2052 Exploit, Issue Tracking, Patch
- https://www.openwall.com/lists/oss-security/2026/05/01/4 Mailing List
- https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce Exploit, Press/Media Coverage, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/01/13 Mailing List
- http://www.openwall.com/lists/oss-security/2026/05/01/4 Mailing List
- https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc Exploit, Third Party Advisory