ProFTPD mod_sql SQL Injection Flaw Enables Authentication Bypass and RCE

A critical SQL injection flaw in ProFTPD's mod_sql module, tracked as CVE-2026-42167, can let remote attackers manipulate database-backed FTP authentication and, in some deployments, achieve remote code execution. The bug affects ProFTPD versions before 1.3.10rc1 and stems from a logic error in is_escaped_text() that can misclassify attacker-controlled quoted input as already escaped when USER requests are logged through SQLNamedQuery expansions such as %U. Advisories and reporting say the weakness can be abused for authentication bypass, privilege escalation, data theft, and arbitrary code execution, with the issue classified as CWE-89 and assigned a CVSS 8.1 severity rating.