CVE-2026-42167

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

• CWE-89

• http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1Release Notes
• https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-pocExploit, Third Party Advisory
• https://github.com/proftpd/proftpd/issues/2052Exploit, Issue Tracking, Patch
• https://www.openwall.com/lists/oss-security/2026/05/01/4Mailing List
• https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rceExploit, Press/Media Coverage, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/05/01/13Mailing List
• http://www.openwall.com/lists/oss-security/2026/05/01/4Mailing List
• https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-pocExploit, Third Party Advisory

Published

Apr 28, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42156Flowsint is an open-source OSINT graph exploration tool desi…7.1
• CVE-2026-42157Flowsint is an open-source OSINT graph exploration tool desi…5.1
• CVE-2026-42158Flowsint is an open-source OSINT graph exploration tool desi…2.3
• CVE-2026-42159Flowsint is an open-source OSINT graph exploration tool desi…5.4
• CVE-2026-4216A weakness has been identified in i-SENS SmartLog App up to …5.3
• CVE-2026-42160Data Space Portal is an open-source Software as a Service (S…10
• CVE-2026-42168django-pyas2 through 1.2.3 is vulnerable to OS command injec…9.1
• CVE-2026-42169A heap-buffer-overflow vulnerability exists in the APNG (Ani…7.3
• CVE-2026-4217A security vulnerability has been detected in XREAL Nebula A…2.5
• CVE-2026-42170A heap-based buffer overflow vulnerability exists in the GIM…7.8
• CVE-2026-42171NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12…7.8
• CVE-2026-42172Coolify is an open-source and self-hostable tool for managin…3.1