ProFTPD’s SQL Injection Vulnerability Enables Remote Code Execution Attacks

Cybersecuritynews •Abinaya • April 30, 2026

A critical SQL injection vulnerability in ProFTPD, one of the Internet’s most widely deployed FTP servers. Tracked as CVE-2026-42167, this flaw carries a CVSS severity score of 8.1 and affects the mod_sql extension. Depending on how the server is configured, attackers can exploit this bug to bypass authentication, elevate their privileges, or achieve remote code execution (RCE). ProFTPD […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in ProFTPD Allows Remote Code Execution A critical SQL injection vulnerability, tracked as CVE-2026-42167, has been identified in ProFTPD, a widely used FTP server. This flaw affects the mod_sql extension and has a CVSS severity score of 8.1. Attackers can exploit this vulnerability to bypass authentication, escalate privileges, and potentially execute remote code, depending on server configurations. The vulnerability was discovered by ZeroPath Research and has been publicly disclosed as of April 28, 2026. Security professionals are urged to assess their ProFTPD installations for this flaw and implement necessary mitigations. The risk is particularly high for systems that have not been updated or configured securely. Immediate action is recommended to prevent potential exploitation. 3 sources 74

Extracted Entities

ProFTPD’s SQL Injection Vulnerability Enables Remote Code Execution Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)