# CVE-2026-42167: ProFTPD mod_sql SQL injection in logging pipeline

Source: https://junglewise.ai/threats/cve-2026-42167-proftpd-mod-sql-sql-injection-in-logging-pipeline  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-42167 · Severity: high · CVSS 8.1 · Published 2026-04-28

A vulnerability in the ProFTPD file transfer service could allow an attacker to take control of the server or its database. By providing a specially crafted username during login, an attacker can bypass security checks and execute unauthorized commands on the backend database. This could lead to the creation of unauthorized administrative accounts, theft of sensitive data, or full system compromise, especially in environments like shared web hosting.

Technologies: [Proftpd](https://junglewise.ai/threats/technologies/proftpd). Vendors: [Proftpd](https://junglewise.ai/threats/vendors/proftpd).

## Quick answers

**Is CVE-2026-42167 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42167 being exploited in the wild.

**How severe is CVE-2026-42167?** High severity, with a CVSS score of 8.1, published 28 April 2026.

**Which products and versions are affected?** ProFTPD Project ProFTPD 1.3.7b to 1.3.9a (exclusive).

**Is there a fix for CVE-2026-42167?** A patch was published on 2026-04-27: Version 1.3.9a released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42167 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42167?** Check whether you run Proftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in ProFTPD's mod_sql module due to a logic error in the is_escaped_text() function. The function fails to properly escape attacker-controlled input if the string starts and ends with a single quote and contains no internal single quotes, allowing an attacker to break out of SQL literals in SQLLog or SQLNamedQuery statements. This is particularly dangerous when variables like %U (username) or %{basename} are used in logging configurations. On PostgreSQL and SQLite backends, which support stacked queries, an unauthenticated attacker can perform an authentication bypass by inserting a backdoor user into the authentication table or achieve remote code execution (RCE) on the database host using commands like 'COPY TO PROGRAM'. The vulnerability is fixed in ProFTPD version 1.3.9a and 1.3.10rc1.

## Affected products

- ProFTPD Project ProFTPD 1.3.7b to 1.3.9a (exclusive)

## Timeline

- 2026-03-28: disclosed: Issue reported to ProFTPD maintainers
- 2026-04-27: patched: Version 1.3.9a released with fix
- 2026-04-28: advisory: Initial CVE publication

## References

- [http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1](http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1)
- [https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc](https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc)
- [https://github.com/proftpd/proftpd/issues/2052](https://github.com/proftpd/proftpd/issues/2052)
- [https://www.openwall.com/lists/oss-security/2026/05/01/4](https://www.openwall.com/lists/oss-security/2026/05/01/4)
- [https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce](https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce)
- [http://www.openwall.com/lists/oss-security/2026/05/01/13](http://www.openwall.com/lists/oss-security/2026/05/01/13)
- [http://www.openwall.com/lists/oss-security/2026/05/01/4](http://www.openwall.com/lists/oss-security/2026/05/01/4)

## Related threats

- [ProFTPD mod_copy symlink traversal in SITE COPY](https://junglewise.ai/threats/cve-2026-119364-proftpd-through-1-3-9e-and-1-3-10rc1-through-1-3-10rc4-contains)
- [ProFTPD buffer overflow in mod_rewrite utf8trans](https://junglewise.ai/threats/cve-2026-119146-proftpd-before-1-3-9e-and-1-3-10rc5-contains-a-buffer-overflow)
- [ProFTPD improper access control in SITE commands](https://junglewise.ai/threats/cve-2015-3306-proftpd-improper-access-control-vulnerability)
- [ProFTPD malicious backdoor in source distribution](https://junglewise.ai/threats/cve-2010-20103-proftpd-malicious-backdoor-in-source-distribution)