ProFTPD mod_sftp Flaw Enables Authenticated Remote Code Execution

A high-severity vulnerability tracked as CVE-2026-63090 affects ProFTPD's mod_sftp module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in fxp.c and another linking it to improper bounds checking in sftp_ssh2_userauth_callback. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement.

Affected versions cited across disclosures include multiple ProFTPD 1.3.8 and 1.3.9 releases prior to patched builds, with fixes reported in versions such as 1.3.8c, 1.3.9b, 1.3.9c, and 1.3.10rc3 depending on branch and advisory. The issue carries a CVSS 8.8 rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable mod_sftp where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.