ProFTPD SQL Injection Flaw Enables Remote Code Execution

A critical SQL injection vulnerability in ProFTPD’s mod_sql extension, tracked as CVE-2026-42167, that enables remote code execution, authentication bypass, and privilege escalation in some configurations, exploitable before authentication.

MITRE has rated the flaw 8.1 on the CVSSv3 severity scale, and a patch is available in ProFTPD version 1.3.9a, released on April 27, 2026.

ProFTPD refers to one of the most widely deployed FTP daemons on the internet, with over 162,000 publicly accessible instances as of April 28, 2026, according to Shodan.

Critical ProFTPD SQL Injection Flaw

According to public analysis, it is included by default in most major Linux distributions and is bundled with popular web hosting control panels, including cPanel, Plesk, DirectAdmin, ISPConfig, and Webmin.

The scale of its deployment makes CVE-2026-42167 a significant supply chain concern for shared hosting environments.

The flaw resides in ProFTPD’s mod_sql extension of a module that enables SQL-backed authentication, quota tracking, ban lists, and logging.

When admins configure mod_sql-based logging using SQLNamedQuery and SQLLog directives, log entries incorporate magic % expansions (e.g., %U for username) that are substituted with live session data before being inserted into a SQL query.

Any value that begins and ends with a single quote and contains no internal single quotes is incorrectly treated as already sanitized, bypassing SQL escaping entirely.

An attacker can exploit this by submitting a crafted username, such as ' || (SELECT 1) ||' during the FTP USER command, effectively injecting arbitrary SQL into the logging query before ever authenticating .

The severity of exploitation depends directly on the server’s configuration:

• Remote Code Execution: When ProFTPD connects to PostgreSQL with superuser privileges, attackers can leverage Postgres command-execution primitives to achieve full RCE.
• Authentication Bypass: If mod_sql handles authentication via SQLAuthenticate, attackers can inject a backdoor user record with a chosen password and home directory, then log in as that user.
• Privilege Escalation: Attackers can set their home directory to /gain unrestricted filesystem browsing beyond their designated FTP root.
• Credential Exfiltration: Using timing-based blind SQL injection, an attacker can extract the contents of arbitrary database tables, including password hashes, character by character.

ZeroPath stated that at least 1% of publicly accessible ProFTPD instances are vulnerable to pre-authentication attacks, with a larger number exposed post-authentication.

The ProFTPD Project released version 1.3.9a on April 27, 2026, which contains the official fix. Debian’s security tracker has formally acknowledged the patch, and Slackware issued a dedicated advisory. 

Mitigation

• Immediately upgrade ProFTPD to version 1.3.9a or later.
• If upgrading is not immediately possible, disable mod_sql-based logging or remove attacker-controlled % expansions (e.g., %U) from SQLNamedQuery statements.
• Restrict SQL backend permissions to prevent execution of superuser commands.
• Monitor FTP logs for unusual USER command patterns or unexpected SQL activity.

Given the public availability of working proof-of-concept exploits and over 160,000 internet-exposed instances, administrators running ProFTPD with mod_sql logging enabled should treat this as a priority patch.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.