ProFTPD SQL Injection Flaw Opens Door To Remote Code Execution Attacks

Gbhackers •Divya • April 30, 2026

A newly disclosed flaw in ProFTPD is drawing urgent attention because it can let attackers move from a simple SQL injection bug to authentication bypass, privilege escalation, and in some environments even remote code execution. Tracked as CVE-2026-42167, the issue was found in ProFTPD’s mod_sql extension by ZeroPath Research, and MITRE assigned it a CVSS […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in ProFTPD Allows Remote Code Execution A critical SQL injection vulnerability, tracked as CVE-2026-42167, has been identified in ProFTPD, a widely used FTP server. This flaw affects the mod_sql extension and has a CVSS severity score of 8.1. Attackers can exploit this vulnerability to bypass authentication, escalate privileges, and potentially execute remote code, depending on server configurations. The vulnerability was discovered by ZeroPath Research and has been publicly disclosed as of April 28, 2026. Security professionals are urged to assess their ProFTPD installations for this flaw and implement necessary mitigations. The risk is particularly high for systems that have not been updated or configured securely. Immediate action is recommended to prevent potential exploitation. 3 sources 74

Extracted Entities

ProFTPD SQL Injection Flaw Opens Door To Remote Code Execution Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)