Reported by 1 outlet
ProFTPD pre-auth SQL injection (CVE-2026-42167, CVSS 8.1) enables RCE, auth bypass, and privilege escalation on 162K+ exposed instances
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 3.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
ProFTPD pre-auth SQL injection (CVE-2026-42167, CVSS 8.1) enables RCE, auth bypass, and privilege escalation on 162K+ exposed instances
cyberpress.org · 167d ago · April 30th, 2026
A critical SQL injection vulnerability in ProFTPD's
mod_sqlextension allows pre-authentication remote code execution, authentication bypass, and privilege escalation. The flaw stems from howmod_sql-based logging handles%expansions (e.g.,%Ufor username) inSQLNamedQuerydirectives — values beginning and ending with single quotes bypass SQL escaping entirely. An attacker can inject arbitrary SQL via a craftedUSERcommand before ever authenticating. When ProFTPD connects to PostgreSQL with superuser privileges, the injection enables full RCE. ZeroPath estimates at least 1% of publicly accessible ProFTPD instances are vulnerable to pre-auth attacks. ProFTPD is bundled with cPanel, Plesk, DirectAdmin, ISPConfig, and Webmin, making this a significant supply-chain risk for shared hosting environments. Patch available in ProFTPD 1.3.9a (released April 27).