Executive Summary

CVE-2026-42167 is a critical pre-authentication SQL injection vulnerability in ProFTPD's mod_sql extension module. A logic flaw in the is_escaped_text() function allows an unauthenticated attacker to bypass SQL character escaping by crafting a USER command whose value satisfies a flawed "already-escaped" heuristic. The injected SQL is passed directly to the backend database via PQexec(), which supports stacked queries.

When the ProFTPD database role is a PostgreSQL superuser — a common misconfiguration in containerized deployments — the injection reaches PostgreSQL's COPY TO PROGRAM directive, resulting in unauthenticated OS-level Remote Code Execution as the postgres system user. No credentials, no prior access, and no user interaction are required.

Affected Software

ProFTPD is a widely deployed open-source FTP server. According to Shodan, over 160,000 publicly accessible ProFTPD instances exist on the internet. The mod_sql module is commonly enabled in shared hosting control panels including cPanel, Plesk, DirectAdmin, Webmin, and ISPConfig.

Vulnerability Description

ProFTPD's mod_sql module supports SQL-backed authentication and activity logging. Log format strings can include substitution variables such as %U (username), %r (remote host), and %m (FTP command). These variables are expanded at runtime and inserted into SQL queries executed against the configured backend.

A typical vulnerable configuration:

In this configuration, the value supplied in the FTP USER command is substituted for %U and included directly in a SQL INSERT statement. Before insertion, the value is passed through is_escaped_text() to determine whether it needs escaping. This function contains a critical logical flaw.

Root Cause Analysis

The Flawed is_escaped_text() Function

Located in contrib/mod_sql.c, the function applies the following heuristic to decide if a string is "already escaped":

When this function returns TRUE, sql_resolved_append_text() (line 777) inserts the raw, unescaped value directly into the query string. The value is then executed by PQexec() in contrib/mod_sql_postgres.c (line 1146), which supports stacked (multi-statement) queries.

Why the Heuristic Fails

The heuristic was likely intended to detect strings that were already surrounded by SQL string delimiters. However, it makes no attempt to verify that the inner content is safe — only that no additional single quotes are present. This means any payload that:

• Begins with '
• Ends with '
• Uses no single quotes internally (e.g., uses PostgreSQL $$ dollar-quoting instead)

...will pass the check and be injected verbatim into the SQL query.

Injection Flow

Prerequisites

The superuser condition is frequently met in containerized deployments where the ProFTPD DB user is created via POSTGRES_USER=... in the official PostgreSQL Docker image, or when an administrator grants the ProFTPD role ownership of the database.

Exploit Chain

Payload Analysis

The injection payload is delivered via the FTP USER command:

Bypass Condition Verification

Payload Breakdown

Proof of Concept

Warning: This PoC is provided for educational and authorized testing purposes only. Do not use against systems you do not own or have explicit written permission to test.

Sample Usage:

Impact

Any system where ProFTPD is co-located with or has superuser access to a PostgreSQL instance is at risk of full host compromise. Lateral movement to adjacent systems and persistence via cron jobs or SSH key injection are trivially achievable post-exploitation.

Remediation

Immediate Action

• Upgrade ProFTPD to version 1.3.9a or later — the fix patches is_escaped_text() with proper parameterized query handling

If Upgrade Is Not Immediately Possible

• Disable mod_sql-based logging entirely (remove SQLLog directives)
• Remove pre-auth logging variables (%U, %r, %m) from SQLNamedQuery definitions

Defense in Depth

• Ensure the ProFTPD database role is not a PostgreSQL superuser (principle of least privilege)
• Restrict the DB role to only INSERT on the log table and SELECT on the auth table
• Place ProFTPD and PostgreSQL in separate network segments where possible
• Monitor FTP logs for USER commands containing single quotes, COPY, PROGRAM, or SQL keywords

Disclosure Timeline

References

• NVD — CVE-2026-42167
• ZeroPath Research Blog — CVE-2026-42167 Auth Bypass and RCE in ProFTPD
• ZeroPathAI — Official PoC Repository
• dinosn — Independent Root Cause Analysis
• ProFTPD Issue #2052 — SQL injection via mod_sql is_escaped_text
• CVEFeed.io — CVE-2026-42167

Legal Disclaimer: This analysis and proof of concept are published strictly for educational, research, and defensive security purposes. The author does not condone unauthorized access to computer systems. Always obtain explicit written permission before conducting security testing against any system you do not own.