ProFTPD mod_sql unauth RCE (CVE-2026-42167) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-42167 is a high-severity remote code execution in ProFTPD mod_sql before 1.3.10rc1 that lets unauthenticated attackers run arbitrary commands on the server by sending a malicious username. Patched in 1.3.10rc1 - update immediately.

Overview

CVE-2026-42167 affects the mod_sql module in ProFTPD, a widely used FTP server. The vulnerability combines two factors: ProFTPD logs USER requests with an expansion such as %U, and the configured SQL backend supports command execution, for example through PostgreSQL’s COPY ... TO PROGRAM. By submitting a specially crafted username containing SQL commands, an unauthenticated attacker can trigger arbitrary code execution on the database server or the ProFTPD host.

Impact

Successful exploitation grants the attacker arbitrary command execution without authentication. Depending on the SQL backend configuration and database user permissions, the attacker could run system commands, exfiltrate data, install malware, or pivot to other internal systems. The CVSS 8.1 score reflects the high impact balanced by the high attack complexity, as the attacker must target a system that uses SQL logging with an %U expansion and a backend that permits commands. However, public PoC code lowers the barrier to exploitation.

Affected Versions

All ProFTPD versions before 1.3.10rc1 are affected. Systems that do not use mod_sql or do not log USER requests with %U are not vulnerable.

Remediation

Upgrade to ProFTPD 1.3.10rc1 or later. As a mitigation, disable SQL logging of USER request expansions such as %U if upgrading is not immediately possible. Ensure the SQL database user used by ProFTPD has minimal privileges — revoke COPY and other command-execution permissions if your backend supports them.

Related reading: iOS Bug Let FBI Recover Deleted Signal Messages highlights how delayed patching of seemingly minor features can lead to data recovery, while LangChain, LangGraph Flaws Expose Files, Secrets, demonstrates a similar pattern of combined features enabling RCE. Apple Fixes WebKit Vulnerability Enabling Same-Origin shows the importance of preventing feature interactions that bypass security boundaries.

Security Insight

CVE-2026-42167 is a textbook example of a vulnerability emerging not from a single buggy function, but from the unintended interaction of two legitimate features: log expansion and SQL command execution. This pattern recurs across open-source projects where feature richness outpaces security review of cross-module interactions. For ProFTPD maintainers, this should prompt a review of all modules that expand user-controlled input, particularly when the output reaches SQL or shell contexts.

Further Reading

• iOS Bug Let FBI Recover Deleted Signal Messages
• LangChain, LangGraph Flaws Expose Files, Secrets,
• Apple Fixes WebKit Vulnerability Enabling Same-Origin
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs