Is CVE-2026-42167 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42167 being exploited in the wild.

How severe is CVE-2026-42167?

High severity, with a CVSS score of 8.1, published 28 April 2026.

Which products and versions are affected?

ProFTPD Project ProFTPD 1.3.7b to 1.3.9a (exclusive).

Is there a fix for CVE-2026-42167?

A patch was published on 2026-04-27: Version 1.3.9a released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42167 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42167?

Check whether you run Proftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42167: ProFTPD mod_sql SQL injection in logging pipeline

CVE-2026-42167 · Severity: high · CVSS 8.1 · Published 2026-04-28

A vulnerability in the ProFTPD file transfer service could allow an attacker to take control of the server or its database. By providing a specially crafted username during login, an attacker can bypass security checks and execute unauthorized commands on the backend database. This could lead to the creation of unauthorized administrative accounts, theft of sensitive data, or full system compromise, especially in environments like shared web hosting.

Technologies: Proftpd. Vendors: Proftpd.

Quick answers

Is CVE-2026-42167 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42167 being exploited in the wild.
How severe is CVE-2026-42167?: High severity, with a CVSS score of 8.1, published 28 April 2026.
Which products and versions are affected?: ProFTPD Project ProFTPD 1.3.7b to 1.3.9a (exclusive).
Is there a fix for CVE-2026-42167?: A patch was published on 2026-04-27: Version 1.3.9a released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42167 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42167?: Check whether you run Proftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in ProFTPD's mod_sql module due to a logic error in the is_escaped_text() function. The function fails to properly escape attacker-controlled input if the string starts and ends with a single quote and contains no internal single quotes, allowing an attacker to break out of SQL literals in SQLLog or SQLNamedQuery statements. This is particularly dangerous when variables like %U (username) or %{basename} are used in logging configurations. On PostgreSQL and SQLite backends, which support stacked queries, an unauthenticated attacker can perform an authentication bypass by inserting a backdoor user into the authentication table or achieve remote code execution (RCE) on the database host using commands like 'COPY TO PROGRAM'. The vulnerability is fixed in ProFTPD version 1.3.9a and 1.3.10rc1.

Affected products

ProFTPD Project ProFTPD 1.3.7b to 1.3.9a (exclusive)

Timeline

2026-03-28: disclosed: Issue reported to ProFTPD maintainers
2026-04-27: patched: Version 1.3.9a released with fix
2026-04-28: advisory: Initial CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.