{"id":"CVE-2026-42167","published":"2026-04-28T00:00:00Z","modified":"2026-05-01T18:22:51Z","title":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where…","vendor":"ProFTPD","product":"ProFTPD","tier":"core","eol":null,"affectedVersions":[{"vendor":"ProFTPD","product":"ProFTPD","versions":[">= 1.3.7b, < 1.3.9a"]}],"description":{"text":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.07389,"percentile":0.94417,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-06-01","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | May 7, 2026","url":"https://otx.alienvault.com/pulse/69fb4ce6957faa5ed109be64","created":"2026-05-06"},{"name":"Known_Cve | May 6, 2026","url":"https://otx.alienvault.com/pulse/69f9fb81b11443144225a3f2","created":"2026-05-05"},{"name":"Known_Cve | May 5, 2026","url":"https://otx.alienvault.com/pulse/69f8a9e71eee0656283c0187","created":"2026-05-04"},{"name":"Known_Cve | May 4, 2026","url":"https://otx.alienvault.com/pulse/69f76ee40a24e43a3a55e9bc","created":"2026-05-03"},{"name":"Known_Cve | May 3, 2026","url":"https://otx.alienvault.com/pulse/69f61d7b1c7b6110a1ea04c5","created":"2026-05-02"},{"name":"Known_Cve | May 2, 2026","url":"https://otx.alienvault.com/pulse/69f4cbdd9d6792f5e0fe1441","created":"2026-05-01"},{"name":"Known_Cve | May 1, 2026","url":"https://otx.alienvault.com/pulse/69f378c160039674e6d8b0e2","created":"2026-04-30"},{"name":"Known_Cve | Apr 30, 2026","url":"https://otx.alienvault.com/pulse/69f22775c0cab1a8490f77d4","created":"2026-04-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1","tags":[]},{"url":"https://github.com/proftpd/proftpd/issues/2052","tags":[]},{"url":"https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce","tags":[]},{"url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","tags":[]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/01/4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/13","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-26157","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26157","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52658,"url":"https://www.exploit-db.com/exploits/52658","title":"CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE","type":"remote","platform":"multiple","date":"2026-08-25","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-08-25"},"pocGithub":{"count":5,"skipped":1,"earliest":"2026-04-28","earliestUrl":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","repos":[{"name":"ZeroPathAI/proftpd-CVE-2026-42167-poc","url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","stars":30,"created":"2026-04-28"},{"name":"dinosn/proftpd-CVE-2026-42167-analysis","url":"https://github.com/dinosn/proftpd-CVE-2026-42167-analysis","stars":3,"created":"2026-04-29"},{"name":"efeanilarslan/CVE-2026-42167-Exploit","url":"https://github.com/efeanilarslan/CVE-2026-42167-Exploit","stars":1,"created":"2026-05-02"},{"name":"jimmexploit/CVE-2026-42167-PoC","url":"https://github.com/jimmexploit/CVE-2026-42167-PoC","stars":1,"created":"2026-05-02"},{"name":"Sl4cK0TH/CVE-2026-42167-PoC","url":"https://github.com/Sl4cK0TH/CVE-2026-42167-PoC","stars":0,"created":"2026-05-01"}]},"nuclei":[{"id":"CVE-2026-42167","name":"ProFTPD mod_sql - Preauth User Backdoor","severity":"high","path":"network/cves/2026/CVE-2026-42167.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-42167.yaml"}],"first":{"date":"2026-04-28","source":"PoC-in-GitHub","url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc"},"provenance":"source"},"exploitRefs":["https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc"],"flow":[],"timeline":[{"date":"2026-04-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-42167","provenance":"source"},{"date":"2026-04-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-08-25","url":"https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":71.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 152 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.88,"detail":"percentile 0.9442"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}