# CVE-2026-44331: ProFTPD SQL injection in mod_wrap2_sql via reverse DNS lookup

Source: https://junglewise.ai/threats/cve-2026-44331-proftpd-sql-injection-in-mod-wrap2-sql-via-reverse-dns-lookup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-44331 · Severity: high · CVSS 8.1 · Published 2026-05-05

ProFTPD is a widely used file transfer server. A security flaw has been identified where an attacker can gain unauthorized access or steal data from the server's database by manipulating the domain name associated with their connection. This could lead to a full compromise of the file server's access control lists and the exposure of sensitive administrative information.

## Quick answers

**Is CVE-2026-44331 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44331 being exploited in the wild.

**How severe is CVE-2026-44331?** High severity, with a CVSS score of 8.1, published 5 May 2026.

**Which products and versions are affected?** ProFTPD ProFTPD Through 1.3.9a before commit 7666224.

**Is there a fix for CVE-2026-44331?** A patch was published on 2026-05-05: Fix committed to ProFTPD source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44331 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44331?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the sqltab_fetch_clients_cb() function within contrib/mod_wrap2_sql.c. When the 'UseReverseDNS' directive is enabled, ProFTPD performs a reverse DNS lookup on connecting IP addresses and passes the resulting hostname directly into a SQL query without proper escaping via sql_escapestring(). An attacker controlling their own reverse DNS records can inject malicious SQL fragments (e.g., using UNION-based techniques or boolean logic) to bypass access controls or extract data from the underlying database. The attack requires the server to be configured with mod_wrap2_sql and UseReverseDNS enabled. A fix is available in the project's source repository (commit 7666224).

## Affected products

- ProFTPD ProFTPD Through 1.3.9a before commit 7666224

## Timeline

- 2026-05-05: disclosed: Issue reported on GitHub and CVE assigned
- 2026-05-05: patched: Fix committed to ProFTPD source repository
- 2026-05-05: advisory

## References

- [https://github.com/proftpd/proftpd/commit/766622456440fbca33abd7927c523673a11d1ed1](https://github.com/proftpd/proftpd/commit/766622456440fbca33abd7927c523673a11d1ed1)
- [https://github.com/proftpd/proftpd/issues/2057](https://github.com/proftpd/proftpd/issues/2057)