CVE-2026-42167:

A SQL injection vulnerability in mod_sql for ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code by supplying a malicious username when USER request logging with expansions like %U is enabled and the SQL backend supports command execution features such as PostgreSQL's COPY TO PROGRAM.

CVE-2026-42167 affects the mod_sql module in ProFTPD versions prior to 1.3.10rc1. The vulnerability is a SQL injection flaw triggered when the FTP server logs USER login requests using SQL query templates containing username expansion variables (e.g., %U). Because the username value supplied by a connecting client is not properly sanitized before being interpolated into SQL statements, a remote attacker can inject arbitrary SQL. When the underlying database backend supports operating system command execution — most notably PostgreSQL's COPY TO PROGRAM directive — this injection can be leveraged to achieve remote code execution on the server host. No authentication is required to trigger the flaw, making it exploitable by any network-accessible attacker, though successful exploitation depends on a specific and non-default server configuration. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (HIGH) reflecting its potential for complete system compromise.