Executive brief
A vulnerability in the ProFTPD file transfer service could allow an attacker to take control of the server or its database. By providing a specially crafted username during login, an attacker can bypass security checks and execute unauthorized commands on the backend database. This could lead to the creation of unauthorized administrative accounts, theft of sensitive data, or full system compromise, especially in environments like shared web hosting.
Technical details
A SQL injection vulnerability exists in ProFTPD's mod_sql module due to a logic error in the is_escaped_text() function. The function fails to properly escape attacker-controlled input if the string starts and ends with a single quote and contains no internal single quotes, allowing an attacker to break out of SQL literals in SQLLog or SQLNamedQuery statements. This is particularly dangerous when variables like %U (username) or %{basename} are used in logging configurations. On PostgreSQL and SQLite backends, which support stacked queries, an unauthenticated attacker can perform an authentication bypass by inserting a backdoor user into the authentication table or achieve remote code execution (RCE) on the database host using commands like 'COPY TO PROGRAM'. The vulnerability is fixed in ProFTPD version 1.3.9a and 1.3.10rc1.
Affected products
- ProFTPD Project ProFTPD 1.3.7b to 1.3.9a (exclusive)
Timeline
- 2026-03-28: disclosed: Issue reported to ProFTPD maintainers
- 2026-04-27: patched: Version 1.3.9a released with fix
- 2026-04-28: advisory: Initial CVE publication
References
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1
- https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
- https://github.com/proftpd/proftpd/issues/2052
- https://www.openwall.com/lists/oss-security/2026/05/01/4
- https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
- http://www.openwall.com/lists/oss-security/2026/05/01/13
- http://www.openwall.com/lists/oss-security/2026/05/01/4