Critical Remote Code Execution via ProFTPD mod_sql SQL Injection (CVE‑2026‑42167)

Critical Remote Code Execution via ProFTPD mod_sql SQL Injection (CVE‑2026‑42167)

What It Is — ProFTPD’s optional mod_sql module logs FTP activity using a user‑supplied filename that is inserted into an SQL statement. A flaw in the module’s escaping routine allows an attacker, after authenticating, to craft a filename that breaks out of the INSERT and injects a second SQL statement. When the backend is PostgreSQL with a super‑user role, the injected statement can invoke COPY … TO PROGRAM, executing an arbitrary OS command and yielding remote code execution.

Exploitability — The vulnerability is publicly disclosed with a working remote exploit (EDB‑ID 52658). No authentication beyond a valid FTP login is required, and the attack works against default configurations that enable mod_sql with a PostgreSQL backend. CVSS ≥ 9.0 (critical) based on remote code execution, network‑only vector, and high impact.

Affected Products — ProFTPD 1.3.7 and later when compiled with the mod_sql module and configured to use a PostgreSQL backend.

Why It Matters for Compliance & Audit Readiness

• Control Mapping: The flaw highlights gaps in your change‑management and configuration‑control processes—key SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) controls.
• Continuous Evidence: Demonstrating timely patching and hardening of FTP services requires automated evidence collection; a missed patch can be a material audit finding.
• Due Diligence: Enterprise customers increasingly demand proof that you monitor and remediate critical vulnerabilities as part of your SOC 2 readiness posture.

Recommended Actions

1. Patch Immediately – Upgrade to the latest ProFTPD release that includes the fix for CVE‑2026‑42167.
2. Review Configuration – Disable mod_sql if not required, or restrict its use to least‑privilege database accounts.
3. Log & Monitor – Enable detailed FTP audit logging and set up alerts for anomalous STOR commands or unexpected database activity.
4. Map to SOC 2 Controls – Record the remediation in your change‑management system and capture the patch‑deployment evidence for SOC 2 audit reviewers.

Source: Exploit Database – CVE‑2026‑42167