CVE-2026-42167: Remote Code Execution via ProFTPD mod_sql

CVE-2026-42167 is a critical vulnerability affecting the ProFTPD server, specifically within the mod_sql module. This vulnerability allows an authenticated user to perform SQL injection attacks, which can be further weaponized to achieve remote code execution on the underlying host. The vulnerability was disclosed alongside a functional exploit (EDB-52658), significantly increasing the risk to environments where ProFTPD is deployed with SQL-based authentication or logging enabled. Defenders should prioritize patching or disabling the mod_sql module if it is not strictly required, as the public availability of the exploit simplifies the path to system compromise for attackers who have obtained valid FTP credentials.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the ProFTPD service. This can lead to full system compromise, data exfiltration, and lateral movement within the network. The scope of impact is limited to servers running ProFTPD with the mod_sql module enabled.

Recommendation

• Apply vendor patches for CVE-2026-42167 across all affected ProFTPD instances immediately.
• Disable the mod_sql module in the ProFTPD configuration file if it is not necessary for business operations.
• Monitor authentication logs for suspicious patterns originating from authenticated FTP users, specifically those interacting with database-backed authentication components.