8.1

CVE-2026-42167: proftpd

Analyzed
AliasesUBUNTU-CVE-2026-42167DEBIAN-CVE-2026-42167openSUSE-SU-2026:11352-1
Published 28-04-2026Last modified 01-05-2026

Vulnerability summary

CVE-2026-42167 is a high (CVSS 8.1) vulnerability in proftpd. EPSS estimates a 7.39% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 4 public exploits are recorded.

Priority
Prioritisepublic exploit

Public exploit (exploit-database, 25-08-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
7.39%
0%100%
Low · +0.08 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits4github, reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 1
MGASA-2026-0200

Timeline

  1. 28-04-2026
    PublishedVulnerability first disclosed.
  2. 01-05-2026
    Last modifiedVulnerability information updated.

Description

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

7.39%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

Increase +0.08 pp

From 7.31% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found
  • githubUnverified

    Proftpd

    Maturity: poc

  • githubUnverified

    Proftpd Cve 2026 42167 Poc

    Maturity: poc

  • referenceUnverified

    Exploit Reference (zeropath.com)

    Maturity: unknown

Show all 4 exploits
  • exploit-databaseremotemultipleUnverified

    CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine1 product
  • proftpd< 1.3.9a-r0
Debian1 product
  • proftpd-dfsg< 1.3.8+dfsg-4+deb12u5 | < 1.3.8.c+dfsg-4+deb13u2 | < 1.3.9~dfsg-5
Opensuse1 product
  • proftpd&distro=openSUSE Tumbleweed< 1.3.9c-1.1
Proftpd1 product
  • proftpd≥ 1.3.7b, < 1.3.9a | ≤ 1.3.9b
Ubuntu1 product
  • proftpd-dfsgAll versions (No fix recorded)

5 vendors · 5 products

References

12 links
Show all 12 references