ZeroHour

CVE-2026-42167

PoC ×3
CVSS 3.1
8.1 high
EPSS
7%p94
Published
()
Modified
Description

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

Vendors
proftpd
Products
proftpd
Weakness
CWE-89
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In the news

[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.

Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.

Exploit-DB · 21d agoExploit / PoCCVE-2026-421671