Loading vulnerability…
Authenticated remote code execution in ProFTPD mod_sftp
CVE-2026-63090 is a heap-based buffer overflow in ProFTPD's mod_sftp module affecting versions before the fixed releases 1.3.9c and 1.3.10rc3. An authenticated, low-privilege attacker can submit crafted SFTP packet fragments exceeding a 16 KB reassembly buffer. An incorrectly conditioned reallocation permits corruption of pool freelist metadata and replacement of the root_fs BSS global pointer with a reference to a fake filesystem structure. A crafted RENAME request can then redirect pr_fsio_stat() to system(), enabling arbitrary code execution. A conflicting account attributes the vulnerability to SSH authentication processing in sftp_ssh2_userauth_callback and identifies different affected and fixed versions; that discrepancy remains unresolved.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the affected ProFTPD process. The exploit chain corrupts heap metadata and redirects a filesystem operation to command execution. A conflicting authentication-handler account additionally describes possible file exfiltration, backdoor installation, and pivoting to internal networks; these outcomes are not independently established for the packet-reassembly exploit chain. The resulting execution privileges are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable mod_sftp when it is unnecessary and restrict SSH/SFTP access to trusted users and networks. Monitor SSH and ProFTPD logs for unusual authentication activity or crashes. Access restrictions reduce exposure but do not eliminate the risk from an attacker with valid permitted credentials.
Patch, then assume compromise.
Upgrade ProFTPD to 1.3.9c or later in the applicable stable release branch, or replace affected release-candidate builds with 1.3.10rc3 or a later fixed release. Ensure the mod_sftp component is updated. For affected EulerOS installations, install the updated proftpd packages supplied by the distribution. A conflicting account identifies 1.3.8c and 1.3.9b as fixes; those earlier versions should not be relied upon because the principal vulnerability description identifies later fixed releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.