Executive brief
ProFTPD is a widely used file transfer server. A security flaw has been identified where an attacker can gain unauthorized access or steal data from the server's database by manipulating the domain name associated with their connection. This could lead to a full compromise of the file server's access control lists and the exposure of sensitive administrative information.
Technical details
A SQL injection vulnerability exists in the sqltab_fetch_clients_cb() function within contrib/mod_wrap2_sql.c. When the 'UseReverseDNS' directive is enabled, ProFTPD performs a reverse DNS lookup on connecting IP addresses and passes the resulting hostname directly into a SQL query without proper escaping via sql_escapestring(). An attacker controlling their own reverse DNS records can inject malicious SQL fragments (e.g., using UNION-based techniques or boolean logic) to bypass access controls or extract data from the underlying database. The attack requires the server to be configured with mod_wrap2_sql and UseReverseDNS enabled. A fix is available in the project's source repository (commit 7666224).
Affected products
- ProFTPD ProFTPD Through 1.3.9a before commit 7666224
Timeline
- 2026-05-05: disclosed: Issue reported on GitHub and CVE assigned
- 2026-05-05: patched: Fix committed to ProFTPD source repository
- 2026-05-05: advisory