Log in Start free

Vulnerability · Published Apr 28, 2026 · Assigned by mitre

CVE-2026-42167

High 8.1

In plain English

A high-severity SQL injection in ProFTPD from ProFTPD. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.4% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)7.4%top 5.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC

Official description

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22proftpd1.3.9a-r0ALPINE-CVE-2026-42167
Alpine:v3.23proftpd1.3.9a-r0ALPINE-CVE-2026-42167
Alpine:v3.24proftpd1.3.9a-r0ALPINE-CVE-2026-42167
Debian:12proftpd-dfsg1.3.8+dfsg-4+deb12u5DEBIAN-CVE-2026-42167
Debian:13proftpd-dfsg1.3.8.c+dfsg-4+deb13u2DEBIAN-CVE-2026-42167
Debian:14proftpd-dfsg1.3.9~dfsg-5DEBIAN-CVE-2026-42167
Ubuntu:22.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-42167
Ubuntu:24.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-42167
Ubuntu:25.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-42167
Ubuntu:26.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-42167
Ubuntu:26.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-42167

Affected products (as reported)

VendorProductVersions
ProFTPD ProFTPD 1.3.7b – before 1.3.9a

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References