Loading story…
A high-severity vulnerability tracked as CVE-2026-63090 affects ProFTPD's mod_sftp module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in fxp.c and another linking it to improper bounds checking in sftp_ssh2_userauth_callback. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement.
Affected versions cited across disclosures include multiple ProFTPD 1.3.8 and 1.3.9 releases prior to patched builds, with fixes reported in versions such as 1.3.8c, 1.3.9b, 1.3.9c, and 1.3.10rc3 depending on branch and advisory. The issue carries a CVSS 8.8 rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable mod_sftp where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Sources disclose CVE-2026-63090 as a high-severity heap-based buffer overflow in ProFTPD's mod_sftp module that can allow remote code execution by an authenticated low-privilege attacker. The reports describe crafted SFTP or SSH authentication input as the trigger and note affected ProFTPD versions across multiple release branches.
Reference content states that the ProFTPD mod_sftp heap buffer overflow tracked as CVE-2026-63090 was remediated in newer versions. One source recommends upgrading to 1.3.9c or 1.3.10rc3 or later, while another says fixes were issued in 1.3.8c and 1.3.9b.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical SQL injection flaw in ProFTPD's `mod_sql` module, tracked as **CVE-2026-42167**, can let remote attackers manipulate database-backed FTP authentication and, in some deployments, achieve remote code execution. The bug affects ProFTPD versions before **`1.3.10rc1`** and stems from a logic error in `is_escaped_text()` that can misclassify attacker-controlled quoted input as already escaped when `USER` requests are logged through `SQLNamedQuery` expansions such as `%U`. Advisories and reporting say the weakness can be abused for authentication bypass, privilege escalation, data theft, and arbitrary code execution, with the issue classified as **CWE-89** and assigned a **CVSS 8.1** severity rating.
Jun 29, 2026
A high-severity vulnerability, tracked as **CVE-2026-35025**, was publicly disclosed in **ProFTPD** affecting versions through `1.3.9b` and `1.3.10rc2`. The flaw is a post-authentication access control bypass in the `RNFR` command handler that lets valid FTP users evade configured `<Directory>` ACL restrictions by prefixing paths with `/proc/self/root`. The issue stems from unresolved symlink handling in `dir_canonical_path()`, causing `dir_check()` to rely on lexical path comparisons that may fail to match the intended directory policy. Successful exploitation can allow an authenticated user to rename files inside `DenyAll`-protected directories using `RNFR` and `RNTO`, and then potentially retrieve those files afterward. The vulnerability is remotely exploitable and has been rated high severity, with reported scores of **8.6 (CVSS 4.0)** and **8.1 (CVSS 3.1)**. Advisories note that deployments using **DefaultRoot** are not affected because the chroot environment changes how `/proc/self/root` resolves, and affected organizations are advised to upgrade to a non-vulnerable ProFTPD release.
Jun 29, 2026
Two vulnerabilities in **sshfs** were disclosed and fixed in version **3.7.6**, affecting versions up to **3.7.5**. The more severe issue, **CVE-2026-47187**, is a symlink escape flaw that lets a rogue SFTP server trick the client into reading from or writing to unintended paths on the local filesystem by returning unsafe symlink targets. The second bug, **CVE-2026-48711**, is an argument injection weakness in hostname parsing that can turn a crafted mount source into an SSH option, enabling arbitrary local command execution under specific conditions and, in some cases, without requiring SSH authentication. Public technical details and exploit code have now been released, raising the risk of active abuse against systems that use sshfs to mount remote directories over SFTP. The flaws were privately reported by Abhinav Agarwal and addressed through a coordinated release, but defenders are being urged to upgrade immediately to **sshfs 3.7.6 or later** and verify trusted remote server keys, as a malicious or spoofed server could otherwise trigger client-side compromise.
Jun 29, 2026