{"id":"CVE-2026-42167","title":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROG…","summary":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROG…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"proftpd","product":"proftpd","affected":["proftpd <= 1.3.9b"],"published":"2026-04-28","updated":"2026-07-08","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42167","references":[{"url":"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1","label":"cve@mitre.org"},{"url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","label":"cve@mitre.org"},{"url":"https://github.com/proftpd/proftpd/issues/2052","label":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2026/05/01/4","label":"cve@mitre.org"},{"url":"https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/13","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available"],"epss":0.07389,"epssPercentile":0.94156,"ingestedAt":"2026-07-08T03:46:38.668Z","exploitAvailable":true,"exploits":{"exploitdb":true,"github":6,"githubRepos":["https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","https://github.com/dinosn/proftpd-CVE-2026-42167-analysis","https://github.com/jimmexploit/CVE-2026-42167-PoC"],"nuclei":["network/cves/2026/CVE-2026-42167"],"checkedAt":"2026-09-24T07:53:03.324Z"},"slug":"CVE-2026-42167","body":"## Overview\n\nmod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).\n\n## Affected\n\n- `proftpd <= 1.3.9b`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":44.6,"likelihood":1.5,"exploitation":12,"ransomware":0},"changes":[{"seq":193,"id":"CVE-2026-42167","ts":1787776815559,"field":"exploit_available","old":"false","new":"true"}]}