Remote Code Execution Vulnerability in ProFTPD's mod_sql

CVE-2026-42167

What is CVE-2026-42167?

CVE-2026-42167 is a significant remote code execution vulnerability found in the mod_sql module of ProFTPD, a widely used open-source FTP server software. This vulnerability has been identified in versions prior to 1.3.9a. It allows remote attackers to execute arbitrary code by exploiting certain conditions related to the logging of USER requests. Specifically, the vulnerability arises when user input is processed in scenarios involving SQL backends that permit command execution, such as using the COPY TO PROGRAM function.

The impact of this vulnerability is particularly severe as it may allow attackers to fully compromise systems running vulnerable versions of ProFTPD, potentially leading to unauthorized access to sensitive data or control over the affected server. Given the critical role of FTP servers in file transfer and management across a wide array of industries, the exploitation of CVE-2026-42167 poses a substantial threat to organizations relying on this software for secure data handling.

Potential impact of CVE-2026-42167

1. System Compromise: Successful exploitation of CVE-2026-42167 can lead to complete control over the affected server, allowing attackers to manipulate files, deploy malware, or utilize the server for further attacks.

2. Data Breaches: Through remote code execution, attackers could access sensitive or proprietary information stored on compromised systems, resulting in data leaks and potential regulatory non-compliance.

3. Service Disruption: Exploitation of this vulnerability could lead to significant service disruptions, as compromised servers may be taken offline for remediation efforts, affecting business operations and customer trust.

References