CVE-2026-42167
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
- Published Apr 28, 2026
- CVSS 8.1 high
- 7.3% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available
Affected software
In the news
- CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE Exploit Database ·