Critical SQL Injection Vulnerability in ProFTPD Allows Remote Code Execution

Severity: High (Score: 74.0)

Sources: Cybersecuritynews, Gbhackers

Summary

A critical SQL injection vulnerability, tracked as CVE-2026-42167, has been identified in ProFTPD, a widely used FTP server. This flaw affects the mod_sql extension and has a CVSS severity score of 8.1. Attackers can exploit this vulnerability to bypass authentication, escalate privileges, and potentially execute remote code, depending on server configurations. The vulnerability was discovered by ZeroPath Research and has been publicly disclosed as of April 28, 2026. Security professionals are urged to assess their ProFTPD installations for this flaw and implement necessary mitigations. The risk is particularly high for systems that have not been updated or configured securely. Immediate action is recommended to prevent potential exploitation. Key Points: • CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's mod_sql extension. • The flaw allows for authentication bypass, privilege escalation, and remote code execution. • Security professionals should assess and patch affected ProFTPD installations immediately.

Key Entities

• Sql Injection (attack_type)
• CVE-2026-42167 (cve)
• Cwe-89 - SQL Injection (cwe)
• T1190 - Exploit Public-Facing Application (mitre_attack)
• ProFTPD (platform)