ProFTPD CVE-2026-42167

Exploitation requires all of the following concrete conditions: ProFTPD before 1.3.10rc1 running mod_sql; a logging configuration that records USER requests using a username expansion such as %U (so the raw pre-auth username is placed into a SQL query); and a SQL backend that permits command execution, with the description explicitly citing PostgreSQL's COPY TO PROGRAM as the escalation primitive. The username is accepted pre-authentication (PR:N), so no valid credentials are needed. Limiting factors that reduce real-world exposure: this is NOT the default configuration (USER-request %U logging must be enabled), the backend database role must be privileged enough to run command sinks like COPY TO PROGRAM, and CVSS AC:H plus SSVC Automatable=no reflect that these preconditions make exploitation non-trivial and non-mass-scannable. Where these conditions are absent, the flaw is not exploitable to RCE.

Signals are mixed and should be weighed together rather than by CVSS alone. CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects unauthenticated network reach with total impact but high attack complexity - the AC:H is meaningful here because exploitation is gated on non-default configuration (USER logging with %U) AND a permissive SQL backend. SSVC aligns with this: exploitation status 'poc' (not active), Automatable 'no' (consistent with the configuration dependency), Technical Impact 'total'. EPSS is low (0.24%, 46th percentile) and there is no KEV listing, so despite the availability of public POC code, real-world mass exploitation is not indicated - risk is realistic but conditional and likely targeted rather than opportunistic. Bottom line: this is a genuine RCE priority for any environment matching the vulnerable configuration, but a lower priority for the majority of ProFTPD installs that do not log USER via %U or do not use a command-capable SQL backend. Verify your own logging directives and SQL backend privileges before assuming exposure.

An attacker connects to an internet-exposed ProFTPD server and sends a USER command whose username contains crafted SQL. On a server that logs USER requests with a %U expansion into a PostgreSQL backend, the payload injects a COPY TO PROGRAM statement that executes shell commands under the database account, yielding remote code execution before authentication. A public POC (github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc) demonstrates the chain, though the AC:H complexity means the target must match the vulnerable logging and backend configuration.