{"id":"CVE-2026-42167","aliases":["ALPINE-CVE-2026-42167","DEBIAN-CVE-2026-42167","EUVD-2026-26157","GHSA-q25r-7mmc-3mcj","MGASA-2026-0200","OESA-2026-2158","OESA-2026-2159","OESA-2026-2264","OESA-2026-2266","OESA-2026-2760","SUSE-SU-2026:5181-1","UBUNTU-CVE-2026-42167","openSUSE-SU-2026:11352-1"],"status":"published","title":"mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a...","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.07389,"percentile":0.94501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2026-04-28T00:00:00Z","modified":"2026-11-11T13:00:04Z","exploits":[{"source":"pocgithub","id":"ZeroPathAI/proftpd-CVE-2026-42167-poc","title":"ZeroPathAI/proftpd-CVE-2026-42167-poc","date":"2026-04-28","url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc"},{"source":"pocgithub","id":"dinosn/proftpd-CVE-2026-42167-analysis","title":"dinosn/proftpd-CVE-2026-42167-analysis","date":"2026-04-29","url":"https://github.com/dinosn/proftpd-CVE-2026-42167-analysis"},{"source":"pocgithub","id":"Sl4cK0TH/CVE-2026-42167-PoC","title":"Sl4cK0TH/CVE-2026-42167-PoC","date":"2026-05-01","url":"https://github.com/Sl4cK0TH/CVE-2026-42167-PoC"},{"source":"pocgithub","id":"efeanilarslan/CVE-2026-42167-Exploit","title":"efeanilarslan/CVE-2026-42167-Exploit","date":"2026-05-02","url":"https://github.com/efeanilarslan/CVE-2026-42167-Exploit"},{"source":"pocgithub","id":"jimmexploit/CVE-2026-42167-PoC","title":"jimmexploit/CVE-2026-42167-PoC","date":"2026-05-02","url":"https://github.com/jimmexploit/CVE-2026-42167-PoC"},{"source":"pocgithub","id":"kaleth4/CVE-2026-42167","title":"kaleth4/CVE-2026-42167","date":"2026-05-04","url":"https://github.com/kaleth4/CVE-2026-42167"},{"source":"exploitdb","id":"EDB-52658","title":"CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE","type":"remote","platform":"multiple","date":"2026-08-25","url":"https://www.exploit-db.com/exploits/52658"},{"source":"nuclei","id":"CVE-2026-42167","title":"ProFTPD mod_sql - Preauth User Backdoor","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-42167.yaml"}],"fixes":[{"ecosystem":"Alpine:v3.22","package":"proftpd","fixed_in":["1.3.9a-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"proftpd","fixed_in":["1.3.9a-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"proftpd","fixed_in":["1.3.9a-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"proftpd-dfsg","fixed_in":["1.3.8+dfsg-4+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"proftpd-dfsg","fixed_in":["1.3.8.c+dfsg-4+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"proftpd-dfsg","fixed_in":["1.3.9~dfsg-5"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"proftpd","fixed_in":["1.3.9a-1.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"proftpd","fixed_in":["1.3.9a-1.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"proftpd","fixed_in":["1.3.8b-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"proftpd","fixed_in":["1.3.9c-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-4+deb12u5"}]}],"versions":["1.3.8+dfsg-4","1.3.8+dfsg-4+deb12u1","1.3.8+dfsg-4+deb12u2","1.3.8+dfsg-4+deb12u3","1.3.8+dfsg-4+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.c+dfsg-4+deb13u2"}]}],"versions":["1.3.8.c+dfsg-4","1.3.8.c+dfsg-4+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9~dfsg-5"}]}],"versions":["1.3.8.c+dfsg-4","1.3.9~dfsg-1","1.3.9~dfsg-2","1.3.9~dfsg-3","1.3.9~dfsg-4"]},{"source":"osv","ecosystem":"Mageia:9","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-1.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-1.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9a-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-2","1.3.5a-1","1.3.5a-1build1","1.3.5a-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5d-1","1.3.5e-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.6-6build2","1.3.6c-1","1.3.6c-2","1.3.6c-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.7b+dfsg-1","1.3.7c+dfsg-1build1","1.3.7c+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg-8","1.3.8.a+dfsg-1","1.3.8.b+dfsg-1","1.3.8.b+dfsg-1build1","1.3.8.b+dfsg-1build2","1.3.8.b+dfsg-1build3","1.3.8.b+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8.c+dfsg-2","1.3.8.c+dfsg-4","1.3.9~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9~dfsg-4","1.3.9b~dfsg-1","1.3.9d~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9~dfsg-3","1.3.9~dfsg-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9c-1.1"}]}]}],"products":[{"vendor":"proftpd","product":"proftpd"}],"references":[{"url":"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1","tags":["Release Notes","web"]},{"url":"https://github.com/proftpd/proftpd/issues/2052","tags":["Exploit","Issue Tracking","Patch","report"]},{"url":"https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce","tags":["Exploit","Press/Media Coverage","Third Party Advisory","article"]},{"url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","tags":["exploit","Exploit","Third Party Advisory","package"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/01/4","tags":["Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/4","tags":["Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/13","tags":["Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42167","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q25r-7mmc-3mcj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42167","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42167.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42167","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0200.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35445","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEM6GPOFEILUHBP4D2KWIUHVXL5546WE/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2158","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2159","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44331","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2266","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2760","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265181-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263183","tags":["report"]},{"url":"https://bugzilla.suse.com/1264262","tags":["report"]},{"url":"https://bugzilla.suse.com/1269065","tags":["report"]},{"url":"https://bugzilla.suse.com/1271096","tags":["report"]},{"url":"https://bugzilla.suse.com/1271097","tags":["report"]},{"url":"https://bugzilla.suse.com/1271944","tags":["report"]},{"url":"https://bugzilla.suse.com/1271945","tags":["report"]},{"url":"https://bugzilla.suse.com/1271946","tags":["report"]},{"url":"https://bugzilla.suse.com/1289272","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-119147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63091","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42167","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42167","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-05-01T18:22:51.5Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-26157","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-05-01T18:22:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:18.340967Z"}],"ghsa":[{"id":"GHSA-q25r-7mmc-3mcj","title":"mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a...","description":"mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-29T00:30:23Z","modified":"2026-05-01T21:31:19Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:07:52.84276Z"}],"nvd":[{"id":"CVE-2026-42167","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T23:16:20.61Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"ALPINE-CVE-2026-42167","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T23:16:20.61Z","modified":"2026-11-07T08:30:02.901472192Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T08:42:09.695379Z"},{"id":"CVE-2026-42167","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-11-11T13:12:17.133981665Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T03:16:41.950556Z"},{"id":"DEBIAN-CVE-2026-42167","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T23:16:20.61Z","modified":"2026-10-01T03:03:11.782833535Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2158","title":"proftpd security update","description":"ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple \u0026amp;apos;virtual\u0026amp;apos; FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.\r\n\r\nSecurity Fix(es):\n\nmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.605025387Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2159","title":"proftpd security update","description":"ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple \u0026amp;apos;virtual\u0026amp;apos; FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.\r\n\r\nSecurity Fix(es):\n\nmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.457204888Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2264","title":"proftpd security update","description":"ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple \u0026amp;apos;virtual\u0026amp;apos; FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.\r\n\r\nSecurity Fix(es):\n\nmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)\n\nIn ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When \u0026quot;UseReverseDNS on\u0026quot; is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)","status":"published","published":"2026-05-09T11:11:14Z","modified":"2026-08-18T01:19:57.455385531Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2266","title":"proftpd security update","description":"ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple \u0026amp;apos;virtual\u0026amp;apos; FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.\r\n\r\nSecurity Fix(es):\n\nmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)\n\nIn ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When \u0026quot;UseReverseDNS on\u0026quot; is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.(CVE-2026-44331)","status":"published","published":"2026-05-09T11:11:14Z","modified":"2026-08-18T01:19:52.684284979Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2760","title":"proftpd security update","description":"ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple \u0026amp;apos;virtual\u0026amp;apos; FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.\r\n\r\nSecurity Fix(es):\n\nmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).(CVE-2026-42167)","status":"published","published":"2026-06-24T11:11:41Z","modified":"2026-08-18T01:21:11.015933911Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-42167","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","status":"published","published":"2026-04-28T23:16:00Z","modified":"2026-10-17T12:58:54.48844807Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"MGASA-2026-0200","title":"Updated proftpd packages fix security vulnerabilities","description":"CVE-2026-42167 mod_sql in ProFTPD before 1.3.9a allows remote attackers\nto execute arbitrary code via a username, in scenarios where there is\nlogging of USER requests with an expansion such as %U, and the SQL\nbackend allows commands (e.g., COPY TO PROGRAM).\nCVE-2026-44331 a SQL injection vulnerability in\nsqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote\nattacker to inject arbitrary SQL commands via a crafted domain name that\nis accessed in a reverse DNS lookup. When \"UseReverseDNS on\" is enabled,\nthe attacker-supplied hostname is passed unescaped into SQL queries. The\ncharacter restrictions of DNS names may affect\n","status":"published","published":"2026-06-12T23:28:19Z","modified":"2026-06-12T23:30:04.492235536Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:11352-1","title":"proftpd-1.3.9c-1.1 on GA media","description":"These are all security issues fixed in the proftpd-1.3.9c-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:09.240417306Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:5181-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\n- Authenticated SFTP sessions can overflow the SFTP packet buffer (bsc#1271096).\n- CVE-2026-35025: access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions by\n  prefixing paths with `/proc/self/root` in the RNFR command handler (bsc#1269065).\n- CVE-2026-42167: `mod_sql` allows remote attackers to execute arbitrary code via a username when there is logging of\n  `USER` requests with an expansion such as `%U` and the SQL backend allows `comman` (bsc#1263183).\n- CVE-2026-44331: SQL injection in `sqltab_fetch_clients_cb()` in `contrib/mod_wrap2_sql.c` triggered via crafted domain\n  name from reverse DNS lookup (bsc#1264262).\n- CVE-2026-53994: heap-based buffer overflow reachable by an authenticated SFTP user can lead to denial of service and\n  memory corruption (bsc#1271946).\n- CVE-2026-63090: heap-based buffer overflow in the `mod_sftp` module can lead to arbitrary code execution via crafted\n  SFTP packet fragments (bsc#1271944).\n- CVE-2026-63091: signed integer overflow in the `mod_sftp` module's SCP size-record parser can lead to ASLR bypass via\n  a crafted file size value of `UINT64_MAX` (bsc#1271945).\n- CVE-2026-119147: authorization bypass in the `mod_sftp` copy-file extension handler allows SFTP users to copy any\n  readable file to a new path in write-denied directories (bsc#1289272).\n- Integer overflow via client-provided file size for SCP uploads (bsc#1271097).\n","status":"published","published":"2026-11-10T17:39:43Z","modified":"2026-11-11T13:00:04.395234588Z","updated_at":"2026-11-11T13:08:46.301371Z"}]}}