CVE-2026-42167: pre-auth SQL injection in ProFTPD

An SQL injection vulnerability was discovered in the mod_sql module of the ProFTPD FTP server. It is tracked as CVE-2026-42167 and has a CVSS score of 8.1.

The issue was caused by the is_escaped_text() function. It considered a string safely escaped if it: • started with ' • ended with ' • contained no other single quotes

This heuristic was originally added for the trusted internal call mod_quotatab_sql, to avoid double escaping. However, mod_sql applied it to all data, including values received from the FTP client. As a result, the server accepted user input as part of an SQL command such as USER ''. The value was passed to SQLNamedQuery, passed the check as “already escaped,” and was inserted into the query without calling sql_escapestring.

The attack worked even when authentication failed, if the server logged USER commands through SQLLog ERR_. When PostgreSQL was used, an attacker could leverage stacked queries to add a new FTP account to the SQL table with UID 0 and the home directory /, and then authenticate as that account. If the database allowed COPY TO PROGRAM or a similar mechanism, the SQL injection could lead directly to command execution.

In the fix, the developers separated data sources: client-supplied variables are now forcibly escaped before entering the shared resolver. The flaw had existed since November 2020, and the patch was introduced in commit e6f72848.

Article: https://nefariousplan.com/posts/proftpd-mod-sql-the-heuristic-was-for-one-caller

PoC: https://github.com/dinosn/proftpd-CVE-2026-42167-analysis