CVE-2026-42167

🗓️ 28 Apr 2026 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 63 Views

CVE-2026-42167: ProFTPD mod_sql allows code execution via username with %U if the SQL backend permits commands.

Reporter	Title	Published	Views	Family All 41
GithubExploit	Exploit for CVE-2026-42167	1 May 202613:36	–	githubexploit
GithubExploit	Exploit for CVE-2026-42167	2 May 202613:08	–	githubexploit
GithubExploit	Exploit for CVE-2026-42167	28 Apr 202614:35	–	githubexploit
GithubExploit	Exploit for CVE-2026-42167	4 May 202600:37	–	githubexploit
GithubExploit	Exploit for CVE-2026-42167	29 Apr 202606:52	–	githubexploit
GithubExploit	Exploit for CVE-2026-42167	2 May 202609:09	–	githubexploit
ATTACKERKB	CVE-2026-42167	28 Apr 202600:00	–	attackerkb
AlpineLinux	CVE-2026-42167	28 Apr 202600:00	–	alpinelinux
Information Security Automation	May Linux Patch Wednesday	2 Jun 202611:00	–	avleonov
Circl	CVE-2026-42167	28 Apr 202615:00	–	circl

Vulners

CNA

Node

proftpd proftpdRange1.3.7b–1.3.9a

[
  {
    "defaultStatus": "unaffected",
    "product": "ProFTPD",
    "vendor": "ProFTPD",
    "versions": [
      {
        "lessThan": "1.3.9a",
        "status": "affected",
        "version": "1.3.7b",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
proftpd	www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1
openwall	www.openwall.com/lists/oss-security/2026/05/01/4
zeropath	www.zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
github	www.github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
github	www.github.com/proftpd/proftpd/issues/2052
openwall	www.openwall.com/lists/oss-security/2026/05/01/13
openwall	www.openwall.com/lists/oss-security/2026/05/01/4

01 May 2026 19:16Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.18.1

EPSS0.0699

SSVC