Remote Code Execution Vulnerability in ProFTPD's mod_sql
CVE-2026-42167
8.1HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-42167?
The mod_sql module in ProFTPD prior to version 1.3.10rc1 contains a critical vulnerability that allows remote attackers to execute arbitrary code by sending specially crafted username requests. This occurs in scenarios where USER request logging is enabled with an expansion format like %U, combined with an SQL backend that permits command execution, such as COPY TO PROGRAM. This vulnerability can lead to significant security risks, including unauthorized control over the affected system.
Affected Version(s)
ProFTPD 1.3.7b < 1.3.10rc1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.