CVE-2026-42167
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Apr 28, 2026
Vendor
unknown
Description
mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).