CVE-2026-44331
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in...
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
CVE-2026-44331- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-27484
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
EUVD-2026-27484- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jmg2-v72j-gmvc
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in...
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
GHSA-jmg2-v72j-gmvc- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
CVE-2026-44331- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-44331
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
ALPINE-CVE-2026-44331- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
CVE-2026-44331- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2026-44331
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
DEBIAN-CVE-2026-44331- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2264
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.
Security Fix(es):
mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)
- Record
OESA-2026-2264- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2265
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.
Security Fix(es):
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)
- Record
OESA-2026-2265- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2266
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.
Security Fix(es):
mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)
- Record
OESA-2026-2266- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2267
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.
Security Fix(es):
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)
- Record
OESA-2026-2267- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2268
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.
Security Fix(es):
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)
- Record
OESA-2026-2268- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-44331
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
- Record
UBUNTU-CVE-2026-44331- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0200 No score
Updated proftpd packages fix security vulnerabilities
CVE-2026-42167 mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM). CVE-2026-44331 a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect
- Record
MGASA-2026-0200- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proftpdAlpine:v3.22 |
before 1.3.9b-r0 | 1.3.9b-r0 |
proftpd-dfsgDebian:12 |
All versions, plus listed versions 1.3.8+dfsg-41.3.8+dfsg-4+deb12u11.3.8+dfsg-4+deb12u21.3.8+dfsg-4+deb12u31.3.8+dfsg-4+deb12u4 Show 23 moreShow less1.3.8+dfsg-4+deb12u51.3.8+dfsg-51.3.8+dfsg-61.3.8+dfsg-71.3.8+dfsg-81.3.8.a+dfsg-11.3.8.b+dfsg-11.3.8.b+dfsg-21.3.8.b+dfsg-31.3.8.b+dfsg-41.3.8.c+dfsg-11.3.8.c+dfsg-21.3.8.c+dfsg-31.3.8.c+dfsg-41.3.9a~dfsg-11.3.9b~dfsg-11.3.9c~dfsg-11.3.9d~dfsg-11.3.9~dfsg-11.3.9~dfsg-21.3.9~dfsg-31.3.9~dfsg-41.3.9~dfsg-5 |
None known |
proftpd-dfsgDebian:13 |
before 1.3.8.c+dfsg-4+deb13u3, plus listed versions 1.3.8.c+dfsg-41.3.8.c+dfsg-4+deb13u11.3.8.c+dfsg-4+deb13u2 |
1.3.8.c+dfsg-4+deb13u3 |
proftpd-dfsgDebian:14 |
before 1.3.9a~dfsg-1, plus listed versions 1.3.8.c+dfsg-41.3.9~dfsg-11.3.9~dfsg-21.3.9~dfsg-31.3.9~dfsg-41.3.9~dfsg-5 |
1.3.9a~dfsg-1 |
proftpdMageia:9 |
before 1.3.8c-1.2.mga9 | 1.3.8c-1.2.mga9 |
proftpdopenEuler:22.03-LTS-SP4 |
before 1.3.9a-2.oe2203sp4 | 1.3.9a-2.oe2203sp4 |
proftpdopenEuler:24.03-LTS |
before 1.3.9a-2.oe2403 | 1.3.9a-2.oe2403 |
proftpdopenEuler:24.03-LTS-SP1 |
before 1.3.9a-2.oe2403sp1 | 1.3.9a-2.oe2403sp1 |
proftpdopenEuler:24.03-LTS-SP3 |
before 1.3.9a-2.oe2403sp3 | 1.3.9a-2.oe2403sp3 |
proftpdopenEuler:20.03-LTS-SP4 |
before 1.3.8b-5.oe2003sp4 | 1.3.8b-5.oe2003sp4 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
proftpd-dfsgUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.5-21.3.5a-11.3.5a-1build11.3.5a-1ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.5d-11.3.5e-1build1 |
None known |
proftpd-dfsgUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.6-6build21.3.6c-11.3.6c-21.3.6c-2ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.7b+dfsg-11.3.7c+dfsg-1build11.3.7c+dfsg-1ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.8+dfsg-81.3.8.a+dfsg-11.3.8.b+dfsg-11.3.8.b+dfsg-1build11.3.8.b+dfsg-1build21.3.8.b+dfsg-1build31.3.8.b+dfsg-1ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:25.10 |
All versions, plus listed versions 1.3.8.c+dfsg-21.3.8.c+dfsg-41.3.9~dfsg-3 |
None known |
proftpd-dfsgUbuntu:26.10 |
All versions, plus listed versions 1.3.9~dfsg-41.3.9b~dfsg-11.3.9d~dfsg-1 |
None known |
proftpd-dfsgUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.9~dfsg-31.3.9~dfsg-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44331 is a high vulnerability (CVSS 8.1) in Proftpd, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in proftpd 1.3.9b-r0.
References
github.com/proftpd/proftpd/issues/2057
nvd.nist.gov/vuln/detail/CVE-2026-44331
security.alpinelinux.org/vuln/CVE-2026-44331
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2026-44331
advisories.mageia.org/MGASA-2026-0200.html
bugs.mageia.org/show_bug.cgi?id=35445
lists.fedoraproject.org/archives/list/[email protected]/message/BEM6GPOFEILUHBP4D2KWIUHVXL5546WE
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2264
ubuntu.com/security/CVE-2026-44331
cve.org/CVERecord?id=CVE-2026-44331