CVE-2026-42167

Published April 28th, 2026

View on NVD ↗

CVSS v3

8.1

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

proftpd/proftpd

ProFTPD source code

GitHub

589

ZeroPathAI/proftpd-CVE-2026-42167-poc

POCs to demonstrate CVE-2026-42167 in ProFTPD

GitHub