CVE-2026-42167

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.10rc1

Description A flaw in the mod sql module occurs due to insufficient protection of the SQL query structure. Remote attackers can execute arbitrary code by providing a specially crafted username in scenarios where USER requests are logged using expansions such as %U, provided the SQL backend supports commands like COPY TO PROGRAM. This issue can also lead to authentication bypass.

Recommendations Update to version 1.3.10rc1. As a temporary mitigation, restrict the use of the mod sql module or disable logging of USER requests using the %U expansion.