CVE-2026-42167: SQL injection in ProFTPd prior to 1.3.9a
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42167?
CVE-2026-42167 is classified as a critical vulnerability due to its ability to allow remote code execution via SQL injection.
How do I fix CVE-2026-42167?
To mitigate CVE-2026-42167, upgrade ProFTPD to version 1.3.10rc1 or later, which contains the security fix.
What versions of ProFTPD are affected by CVE-2026-42167?
CVE-2026-42167 affects ProFTPD versions prior to 1.3.9a and including versions up to but not including 1.3.10rc1.
What is the cause of CVE-2026-42167?
CVE-2026-42167 is caused by SQL injection vulnerabilities in mod_sql due to improper handling of user inputs.
Can CVE-2026-42167 lead to unauthorized access?
Yes, CVE-2026-42167 can allow attackers to execute arbitrary code, potentially leading to unauthorized access and system compromise.