CVE-2026-42167

A flaw was found in the modsql module in ProFTPD. This issue allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands e.g., COPY TO PROGRAM...