Loading story…
A critical SQL injection flaw in ProFTPD's mod_sql module, tracked as CVE-2026-42167, can let remote attackers manipulate database-backed FTP authentication and, in some deployments, achieve remote code execution. The bug affects ProFTPD versions before 1.3.10rc1 and stems from a logic error in is_escaped_text() that can misclassify attacker-controlled quoted input as already escaped when USER requests are logged through SQLNamedQuery expansions such as %U. Advisories and reporting say the weakness can be abused for authentication bypass, privilege escalation, data theft, and arbitrary code execution, with the issue classified as CWE-89 and assigned a CVSS 8.1 severity rating.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Public reporting summarized that CVE-2026-42167 can enable remote code execution in certain deployments, especially where SQL backends permit command execution features such as PostgreSQL COPY TO PROGRAM, and recommended upgrading to fixed ProFTPD releases or disabling mod_sql logging.
dCERT published advisory 2026-1276 warning that a ProFTPD vulnerability allows SQL injection, adding official advisory coverage for the issue.
ZeroPath published analysis describing how a logic error in ProFTPD's is_escaped_text() handling of quoted input can let attacker-controlled values reach SQL queries via logging variables such as %U, enabling severe impact depending on backend configuration.
MITRE received CVE-2026-42167 on 2026-04-28 for an SQL injection vulnerability in ProFTPD's mod_sql component that can lead to authentication bypass, privilege escalation, data theft, and in some configurations remote code execution.
An oss-sec post publicly highlighted CVE-2026-42167 in ProFTPD's mod_sql extension, describing SQL injection risks that could lead to authentication bypass, privilege escalation, database manipulation, or remote code execution depending on configuration. The post said the issue was fixed by a specific commit and addressed in ProFTPD 1.3.9a, with 1.3.10rc1 also reportedly containing the fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedcert.de
Open sourcezeropath.com
Open sourcecvefeed.io
Open sourcebugflation.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026
A high-severity vulnerability, tracked as **CVE-2026-35025**, was publicly disclosed in **ProFTPD** affecting versions through `1.3.9b` and `1.3.10rc2`. The flaw is a post-authentication access control bypass in the `RNFR` command handler that lets valid FTP users evade configured `<Directory>` ACL restrictions by prefixing paths with `/proc/self/root`. The issue stems from unresolved symlink handling in `dir_canonical_path()`, causing `dir_check()` to rely on lexical path comparisons that may fail to match the intended directory policy. Successful exploitation can allow an authenticated user to rename files inside `DenyAll`-protected directories using `RNFR` and `RNTO`, and then potentially retrieve those files afterward. The vulnerability is remotely exploitable and has been rated high severity, with reported scores of **8.6 (CVSS 4.0)** and **8.1 (CVSS 3.1)**. Advisories note that deployments using **DefaultRoot** are not affected because the chroot environment changes how `/proc/self/root` resolves, and affected organizations are advised to upgrade to a non-vulnerable ProFTPD release.
Jun 29, 2026
**Fortinet FortiClient Endpoint Management Server (EMS)** contains a critical unauthenticated SQL injection vulnerability, tracked as **CVE-2026-21643** with a **CVSS score of 9.1**, affecting **version 7.4.4** when **multi-tenant mode** is enabled. The flaw was introduced during a middleware refactor that changed database connection and tenant routing logic, allowing the HTTP `Site` header to be passed into a PostgreSQL `search_path` query without proper validation. Because the vulnerable middleware executes before authentication, an attacker can send a crafted HTTPS request and run arbitrary SQL commands without valid credentials. Research cited in the coverage says the publicly exposed `/api/v1/init_consts` endpoint is the most practical attack path because it can reveal whether multi-tenant mode is active, lacks rate limiting, and returns PostgreSQL error messages that support efficient error-based data extraction. Successful exploitation can lead to **full compromise of the EMS management database** and exposure of sensitive information. Commentary in the related podcast segment reinforces that the bug was introduced by the **7.4.4 refactoring** and fixed in **7.4.5**, highlighting how code refactoring can create serious security regressions when input handling and validation are not preserved.
Jun 29, 2026