---
id: CVE-2026-42167
title: >-
  mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary
  code via a username, in scenarios where there is logging of USER requests with
  an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO
  PROG…
summary: >-
  mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary
  code via a username, in scenarios where there is logging of USER requests with
  an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO
  PROG…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: proftpd
product: proftpd
affected:
  - proftpd <= 1.3.9b
published: '2026-04-28'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42167'
references:
  - url: 'http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1'
    label: cve@mitre.org
  - url: 'https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc'
    label: cve@mitre.org
  - url: 'https://github.com/proftpd/proftpd/issues/2052'
    label: cve@mitre.org
  - url: 'https://www.openwall.com/lists/oss-security/2026/05/01/4'
    label: cve@mitre.org
  - url: 'https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/05/01/13'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/05/01/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.07389
epssPercentile: 0.94156
ingestedAt: '2026-07-08T03:46:38.668Z'
exploitAvailable: true
exploits:
  exploitdb: true
  github: 6
  githubRepos:
    - 'https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc'
    - 'https://github.com/dinosn/proftpd-CVE-2026-42167-analysis'
    - 'https://github.com/jimmexploit/CVE-2026-42167-PoC'
  nuclei:
    - network/cves/2026/CVE-2026-42167
  checkedAt: '2026-09-24T07:53:03.324Z'
---

## Overview

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

## Affected

- `proftpd <= 1.3.9b`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.